Security readout for executives and security teams
Plain-English summary
A flaw in the Linux mt7996 Wi-Fi driver can mishandle internal wireless-client records. A non-station record reaching receive-processing code may corrupt a driver array, potentially compromising confidentiality, integrity, and availability. Risk is concentrated on systems using affected kernels with supported MediaTek mt7996 wireless hardware.
Executive priority
Treat as a high-priority kernel update for systems using mt7996 Wi-Fi, especially devices exposed to untrusted nearby wireless users. Systems without that hardware or driver are unlikely to be directly exposed. Establish inventory first, then apply supported kernel updates promptly; no evidence in the bundle supports emergency incident declarations based on active exploitation.
Technical view
The mt76 mt7996 driver failed to reject non-station WCID entries before receive processing. For the global WCID, a container_of cast to mt7996_sta_link could produce an invalid pointer and corrupt the WCID array. The supplied CVSS 3.1 score is 8.8 with adjacent-network access, low complexity, no privileges, and no user interaction.
Likely exposure
Likely exposure is limited to Linux systems running an affected kernel and actively using the mt7996 Wi-Fi driver. The supplied version data lists 6.15, 6.16.6, and 6.17 but does not clearly express exact range boundaries. Confirm exposure against distribution advisories and whether downstream kernels contain either cited fix.
Exploitation context
The vector requires adjacent-network access, indicating an attacker must be within a relevant local wireless context. The bundle provides no triggering details or demonstrated outcomes beyond possible array corruption. This CVE is not listed as KEV, and the supplied sources do not establish active exploitation or a public exploit.
Researcher notes
The security consequence arises from a type and ownership assumption: receive functions expect station WCIDs, but non-station entries were accepted. Casting the global WCID through container_of can derive an invalid mt7996_sta_link pointer and corrupt the WCID array. The sources do not document reachability conditions, reproducibility, crash signatures, or confirmed code execution.
Mitigation direction
- Install a vendor-supported kernel package incorporating one of the cited stable fixes.
- Check Linux distribution advisories for precise affected and corrected package versions.
- If patching is delayed, follow vendor guidance for safely limiting use of affected mt7996 Wi-Fi hardware.
- Prioritize wireless infrastructure and endpoints operating in untrusted or publicly accessible radio environments.
Validation and detection
- Record the running kernel version and distribution package release.
- Confirm whether mt7996 hardware and the mt76 mt7996 driver are present and active.
- Verify the installed kernel source or vendor changelog includes either cited fix commit.
- Recheck vendor advisories because the supplied affected-version boundaries are ambiguous.
- Review relevant kernel logs for mt7996 faults, crashes, or memory-corruption symptoms.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39919 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/69dcc19048fcdc3fb166fd25b805470ee8fc0eb1CVE reference, Linux
- https://git.kernel.org/stable/c/4a522b01e368eec58d182ecc47d24f49a39e440dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.