What’s Vulnerable › Vulnerabilities

CVE-2025-38343: wifi: mt76: mt7996: drop fragments with multicast or broadcast RA

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-10 · updated 2026-07-30

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: drop fragments with multicast or broadcast RA IEEE 802.11 fragmentation can only be applied to unicast frames. Therefore, drop fragments with multicast or broadcast RA. This patch addresses vulnerabilities such as CVE-2020-26145.

Affected products

• Linux kernel: from 6.2 before 6.6.95; from 6.7 before 6.12.35; from 6.13 before 6.15.4 — fixed in 6.12.35, 6.15.4, 6.6.95

How to fix

Upgrade to a fixed version: Linux kernel 6.12.35, 6.15.4, 6.6.95. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/24900688ee47071aa6a61e78473999b5b80f0423
• https://git.kernel.org/stable/c/5fd5b8132b5de08c99eea003f7715ff2e361b007
• https://git.kernel.org/stable/c/80fda1cd7b0a1edd0849dc71403a070d0922118d
• https://git.kernel.org/stable/c/d4b93f9c2f666011dcf810050ef60a6b8d06f186

Get alerted when CVE-2025-38343 or the next vulnerability affects your stack