CVE-2025-39761: Linux Kernel Use-After-Free Vulnerability

CVE-2025-39761 Overview

CVE-2025-39761 is an out-of-bounds access vulnerability [CWE-125] in the Linux kernel's ath12k Wi-Fi driver. The flaw resides in the error handling path of ath12k_dp_rx_peer_frag_setup(), where the Traffic Identifier (TID) counter is not decremented before peer cleanup. This omission allows out-of-bounds access to the peer->rx_tid[] array during RX peer fragment setup failures. The issue was discovered during code review and has been resolved in the mainline Linux kernel through multiple stable branch backports.

Critical Impact
A local, low-privileged attacker can trigger out-of-bounds memory access in the kernel, leading to potential information disclosure or a denial-of-service condition on affected Linux systems using Qualcomm ath12k Wi-Fi hardware.

Affected Products

Linux Kernel (mainline versions prior to the fix commits)
Linux Kernel stable branches containing the ath12k Wi-Fi driver
Systems using Qualcomm Wi-Fi 7 chipsets supported by ath12k

Discovery Timeline

2025-09-11 - CVE-2025-39761 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-39761

Vulnerability Analysis

The vulnerability exists within the Linux kernel's ath12k driver, which supports Qualcomm Wi-Fi 7 wireless chipsets. The affected function, ath12k_dp_rx_peer_frag_setup(), initializes fragment reassembly state for each Traffic Identifier (TID) associated with a wireless peer.

During normal operation, the function iterates over TIDs and sets up per-TID receive state in the peer->rx_tid[] array. When an error occurs partway through this initialization loop, the function invokes peer cleanup logic. The cleanup path assumes the TID counter matches the number of successfully initialized entries.

The defect stems from a missing decrement of the TID counter before invoking cleanup on the error path. As a result, the cleanup routine indexes past the last valid entry in peer->rx_tid[], causing an out-of-bounds read or write against adjacent kernel memory.

Root Cause

The root cause is an accounting error in the error handling path. The TID index is incremented at the start of each loop iteration but is not decremented when the loop body fails midway. The subsequent peer cleanup uses the stale, over-incremented TID value to index into the per-TID fragment array, exceeding the valid array bounds.

Attack Vector

Exploitation requires local access with low privileges on a system running the vulnerable ath12k driver. An attacker must trigger a failure condition inside ath12k_dp_rx_peer_frag_setup(), for example by inducing resource exhaustion or specific hardware states during peer association. The resulting out-of-bounds access can corrupt kernel memory or leak sensitive data. The vulnerability primarily impacts confidentiality and availability, as reflected in the CVSS vector; integrity impact is not assessed.

No public proof-of-concept exploit is available, and the issue was reported as compile-tested only by the upstream developer.

Detection Methods for CVE-2025-39761

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ath12k_dp_rx_peer_frag_setup or rx_tid in dmesg output
KASAN reports flagging out-of-bounds access within the ath12k module on kernels built with memory sanitizers enabled
Wireless interface instability or repeated peer setup failures logged by the ath12k driver

Detection Strategies

Inventory running kernel versions across Linux endpoints and compare against the fixed commits published on git.kernel.org for each stable branch
Enable Kernel Address Sanitizer (KASAN) on test systems to surface out-of-bounds access originating from the ath12k driver during Wi-Fi peer setup
Monitor kernel logs for repeated ath12k peer initialization errors that correlate with system instability

Monitoring Recommendations

Centralize syslog and journalctl collection from Linux hosts and alert on kernel warnings referencing ath12k fragment or TID handling
Track kernel package versions through configuration management to confirm timely deployment of stable kernel updates
Correlate wireless driver errors with subsequent process crashes or memory corruption indicators

How to Mitigate CVE-2025-39761

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as vendor-signed builds become available
Prioritize patching on systems using Qualcomm Wi-Fi 7 hardware with the ath12k driver loaded
Restrict local access on affected systems, as exploitation requires an authenticated local user

Patch Information

The fix decrements the TID counter before invoking peer cleanup in ath12k_dp_rx_peer_frag_setup(), ensuring the cleanup routine only touches valid entries in peer->rx_tid[]. The correction has been applied across multiple stable branches. See the upstream commits: Kernel Git Commit 7c0884f, Kernel Git Commit 7c3e99f, Kernel Git Commit 9530d66, Kernel Git Commit a3b73c7, and Kernel Git Commit eb1e152.

Workarounds

Unload the ath12k module on systems that do not require Qualcomm Wi-Fi 7 functionality using modprobe -r ath12k
Blacklist the ath12k driver in /etc/modprobe.d/ on hosts where the affected wireless hardware is not in active use
Limit local shell access and enforce least-privilege policies to reduce the population of users capable of triggering the error path

bash

# Blacklist the ath12k driver until a patched kernel is deployed
echo "blacklist ath12k" | sudo tee /etc/modprobe.d/blacklist-ath12k.conf
sudo update-initramfs -u
sudo reboot