Security readout for executives and security teams
Plain-English summary
A flaw in the Linux ath12k Wi-Fi driver can access memory outside an expected array when wireless peer setup fails. This may threaten confidentiality, integrity, and availability on affected systems using compatible Qualcomm Wi-Fi hardware. The issue was found during code review, and the supplied evidence does not establish real-world exploitation.
Executive priority
Treat as a high-priority targeted kernel update, especially for exposed wireless endpoints and appliances using ath12k. It does not justify an organization-wide emergency absent confirmed driver use. Inventory affected hardware first, then deploy vendor-supported patched kernels through normal expedited change controls.
Technical view
The error path in ath12k_dp_rx_peer_frag_setup() cleaned up a peer without first decrementing the traffic identifier (TID). That incorrect index could cause out-of-bounds access to peer->rx_tid[]. Referenced Linux stable commits add the missing decrement. The supplied CVSS 3.1 score is 8.8 with adjacent-network reachability and no required privileges or user interaction.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel with the ath12k driver active for supported Wi-Fi hardware. The source lists affected kernel versions or branches, but its flattened version data is ambiguous. Confirm exposure against the exact distribution kernel build and whether it contains a referenced stable fix.
Exploitation context
The CVSS vector indicates an attacker would need adjacent-network access. However, no CISA KEV listing is reported, and the source says the issue was found through code review and only compile-tested. There is no supplied evidence of active exploitation, a public exploit, or demonstrated impact in a running system.
Researcher notes
Evidence supports an error-path indexing defect and source-level correction, but not practical exploitability. Important unknowns include whether an attacker can reliably force the peer-fragment setup failure, the resulting memory access characteristics, and runtime impact. The original report was compile-tested only, so controlled regression and hardware testing remain important.
Mitigation direction
- Update to a vendor-supported kernel release containing the applicable referenced stable fix.
- Confirm the distribution's backport status rather than relying only on its displayed kernel version.
- Prioritize Wi-Fi-enabled systems using ath12k hardware in accessible or untrusted wireless environments.
- Review Linux distribution and hardware-vendor guidance for any additional mitigations.
Validation and detection
- Identify systems using the ath12k driver and compatible Qualcomm Wi-Fi hardware.
- Record exact kernel package versions, distribution revisions, and backported patch identifiers.
- Verify the installed kernel contains the applicable referenced stable commit or vendor equivalent.
- After updating, confirm systems boot normally and Wi-Fi connectivity remains operational.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39761 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6CVE reference, Linux
- https://git.kernel.org/stable/c/7c3e99fd4a66a5ac9c7dd32db07359666efe0002CVE reference, Linux
- https://git.kernel.org/stable/c/a3b73c72c42348bf1555fd2b00f32f941324b242CVE reference, Linux
- https://git.kernel.org/stable/c/9530d666f4376c294cdf4348c29fe3542fec980aCVE reference, Linux
- https://git.kernel.org/stable/c/7c0884fcd2ddde0544d2e77f297ae461e1f53f58CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.