CVE-2025-68380 wifi: ath11k: fix peer HE MCS assignment
A misconfigured access point can crash the Linux kernel's ath11k WiFi driver by triggering a firmware crash due to incorrect MCS assignment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68380?
CVE-2025-68380 is a denial of service vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix peer HE MCS assignment
In ath11k_wmi_send_peer_assoc_cmd(), peer's transmit MCS is sent to firmware as receive MCS while peer's receive MCS sent as transmit MCS, which goes against firmwire's definition.
While connecting to a misbehaved AP that advertises 0xffff (meaning not supported) for 160 MHz transmit MCS map, firmware crashes due to 0xffff is assigned to he_mcs->rx_mcs_set field.
Ext Tag: HE Capabilities [...] Supported HE-MCS and NSS Set [...] Rx and Tx MCS Maps 160 MHz [...] Tx HE-MCS Map 160 MHz: 0xffff
Swap the assignment to fix this issue.
As the HE rate control mask is meant to limit our own transmit MCS, it needs to go via he_mcs->rx_mcs_set field. With the aforementioned swapping done, change is needed as well to apply it to the peer's receive MCS.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Which versions are affected by CVE-2025-68380?
How do I fix CVE-2025-68380?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-68380 being exploited?
There is no known exploitation of CVE-2025-68380 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68380, DEBIAN-CVE-2025-68380, GHSA-96x7-qg22-qw59, ROOT-OS-DEBIAN-12-CVE-2025-68380, ROOT-OS-DEBIAN-13-CVE-2025-68380, ROOT-OS-UBUNTU-2404-CVE-2025-68380 and 1 more.