Security readout for executives and security teams
Plain-English summary
A boundary-checking error in the Linux MediaTek MT7925 Wi-Fi driver can access memory outside an intended array during hardware scanning. The supplied CVSS score is 8.8, reflecting potentially serious confidentiality, integrity, and availability impact from an adjacent network position. Actual exploitability and practical outcomes are not documented in the supplied sources.
Executive priority
Prioritize remediation for laptops, endpoints, and appliances using MT7925 Wi-Fi on potentially affected kernels. The high CVSS score warrants prompt action, but the supplied evidence does not establish active exploitation. Systems without this hardware or driver are unlikely to be exposed.
Technical view
CVE-2025-38600 is an off-by-one out-of-bounds access in mt7925_mcu_hw_scan(), involving the ssid->ssids[] and sreq->ssids[] arrays sized to MT7925_RNR_SCAN_MAX_BSSIDS. Linux stable commits 4d80d4fa986c5da99042b66bf30a028e7f564156 and b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee contain the correction.
Likely exposure
Exposure is limited to Linux systems running an affected kernel with the MediaTek MT7925 Wi-Fi driver and relevant hardware or driver functionality in use. The supplied version data identifies Linux 6.16 within the affected range but presents ambiguous boundaries involving 6.16.1 and 6.17; confirm status with the distributor's advisory and kernel changelog.
Exploitation context
The CVSS vector specifies adjacent-network access, low complexity, no privileges, and no user interaction. However, the bundle provides no proof of concept, observed attacks, or evidence of active exploitation. The CVE is not listed as KEV in the supplied data. Treat the impact ratings as potential consequences, not confirmed exploitation behavior.
Researcher notes
The record describes an array-boundary error during MT7925 hardware scanning, but supplies no crash analysis, reachable input details, proof of concept, or demonstrated primitive. The affected-version representation is not sufficiently clear for exact package decisions. Validate backports by commit presence rather than relying only on upstream version numbers.
Mitigation direction
- Update to a vendor-supported kernel containing one of the referenced stable fixes.
- Confirm the corrected package version with the Linux distribution or appliance vendor.
- Prioritize exposed endpoints that actively use MediaTek MT7925 Wi-Fi hardware.
- If updating is delayed, assess whether the affected driver or hardware can be safely disabled.
Validation and detection
- Inventory kernel versions and identify systems using the mt7925 driver or MT7925 hardware.
- Compare vendor kernel changelogs against both referenced stable fix commits.
- Verify the deployed kernel package after remediation and confirm the corrected build is running.
- Monitor vendor advisories for clarified affected-version boundaries and backport information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38600 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4d80d4fa986c5da99042b66bf30a028e7f564156CVE reference, Linux
- https://git.kernel.org/stable/c/b3a431fe2e399b2e0cc5f43f7e9d63d63d3710eeCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.