CVE-2025-39919: wifi: mt76: mt7996: add missing check for rx wcid entries

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-01 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: add missing check for rx wcid entries Non-station wcid entries must not be passed to the rx functions. In case of the global wcid entry, it could even lead to corruption in the wcid array due to pointer being casted to struct mt7996_sta_link using container_of.

Affected products

Linux kernel: from 6.15 before 6.16.6; 6.17-rc1, 6.17-rc2, 6.17-rc3, 6.17-rc4 — fixed in 6.16.6

How to fix

Upgrade to a fixed version: Linux kernel 6.16.6. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/4a522b01e368eec58d182ecc47d24f49a39e440d
https://git.kernel.org/stable/c/69dcc19048fcdc3fb166fd25b805470ee8fc0eb1

Get alerted when CVE-2025-39919 or the next vulnerability affects your stack