CVE-2025-39862

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The mt7915 driver is an 802.11 device driver whose reset path is armed by firmware watchdog exceptions and MCU command timeouts driven by received wireless traffic, and the corrupted lists are then exercised by the RX/TX paths for frames from stations in radio range. Per kernel scoring guidance WiFi driver bugs reachable by frame injection are Adjacent.

AC:LAttack complexity, low

The attacker generates every required condition with their own traffic — flooding auth/assoc requests and malformed management frames to force the firmware exception or MCU timeout that queues the full reset, and associating/deauthing stations to control which wcids remain on the stale lists and which sta slabs are freed and reallocated. Nothing depends on state outside the attacker's influence.

PR:NPrivileges required, none

No credentials on the target are required; unassociated frame injection (probe/auth/assoc floods, deauth) is sufficient to both trigger the reset and populate the stale wcid entries, and an attacker on an open or guest WLAN holds no privilege on the AP.

UI:NUser interaction, none

The corruption happens autonomously inside the driver's reset work, mac80211 reconfig and tx worker in response to attacker-generated frames. No administrator or local user action is involved.

S:UScope, unchanged

The corrupted list heads, stale RCU pointers and resulting writes are all confined to kernel memory under the kernel's own security authority. No VM, IOMMU or sandbox boundary is crossed.

C:HConfidentiality impact, high

Dangling `dev->wcid[]` entries surviving the reset are dereferenced by the RX and TX-status fastpaths after mac80211 frees the backing `ieee80211_sta` objects, giving out-of-bounds and use-after-free reads of attacker-groomable slab memory, and the traversal of `dev->wcid_list`/`phy->tx_list` leaks kernel pointers. Per the use-after-free guidance this rates High.

I:HIntegrity impact, high

`list_add_tail()`/`list_del_init()` on the reinitialized-but-still-linked nodes write kernel pointers into freed and reallocated station objects (`prev->next`, `next->prev`), and the RX path writes through stale wcid pointers (`rx_key_pn` memcpy, RSSI/stat updates, poll-list insertion) — a controllable kernel write primitive suitable for control-flow hijacking.

A:HAvailability impact, high

List corruption plus dereference of dangling wcid pointers reliably oopses or panics the kernel; with CONFIG_DEBUG_LIST it is an immediate list-corruption BUG, and the cross-linked heads can spin `mt76_txq_schedule_pending()`'s `while (!list_empty(&tx_list))` forever with `phy->tx_lock` held and BHs disabled, hanging the AP.