CVE-2025-38600 (GCVE-0-2025-38600)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:03 – Updated: 2026-08-05 12:03
VLAI
Title
wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan() The ssid->ssids[] and sreq->ssids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS elements so this >= needs to be > to prevent an out of bounds access.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8284815ca161e0fa0861cc4085f1c0141e10a34d , < 4d80d4fa986c5da99042b66bf30a028e7f564156 (git)
Affected: 8284815ca161e0fa0861cc4085f1c0141e10a34d , < b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee (git)
Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4d80d4fa986c5da99042b66bf30a028e7f564156",
              "status": "affected",
              "version": "8284815ca161e0fa0861cc4085f1c0141e10a34d",
              "versionType": "git"
            },
            {
              "lessThan": "b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee",
              "status": "affected",
              "version": "8284815ca161e0fa0861cc4085f1c0141e10a34d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()\n\nThe ssid-\u003essids[] and sreq-\u003essids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS\nelements so this \u003e= needs to be \u003e to prevent an out of bounds access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The attacker-controlled input is the Reduced Neighbor Report element carried in 802.11 beacons/probe responses, which cfg80211 parses into scan_6ghz_params and the driver copies into mdev-\u003ernr.bssid[] before the buggy loop. This requires the attacker to transmit frames within WiFi radio range of the victim, which is the adjacent-network case.\nAC:L - The attacker fully controls the RNR contents and simply beacons \u226511 distinct colocated 6 GHz BSSIDs to push mdev-\u003ernr.bssid_num past 10; mt7925 is a widely deployed Wi-Fi 7 chip and 6 GHz colocated scanning is the default behaviour of modern supplicants. No condition outside the attacker\u0027s influence is required.\nPR:N - The attacker needs no account or credentials on the target and need not even be associated with it \u2014 an unauthenticated rogue AP in range suffices, since the victim\u0027s own routine background scan (performed by the privileged supplicant) consumes the malicious RNR data.\nUI:N - Periodic background scanning by wpa_supplicant/NetworkManager/Android occurs automatically without any user action, so the attacker only has to keep beaconing until the next scan cycle.\nS:U - The out-of-bounds access occurs in kernel driver memory and any resulting corruption or crash is confined to the kernel\u0027s own security authority, with no crossing into a hypervisor, IOMMU, or sandbox boundary.\nC:H - The off-by-one is an out-of-bounds array/buffer write in the MCU command skb; per kernel scoring guidance memory corruption of this kind is treated as leverageable for information disclosure, and the malformed extra TLV is also handed to device firmware that parses it as trusted host data.\nI:H - An out-of-bounds write one element past a fixed-size array (36 bytes past struct scan_ssid_tlv, and a 16-byte TLV past the computed skb budget) is memory corruption, which per guidance scores High for integrity.\nA:H - Writing past the computed max_len budget via skb_put() risks exceeding the skb tail, which triggers skb_over_panic() -\u003e BUG() and a kernel panic; the malformed over-long scan command can additionally wedge the WiFi MCU, denying connectivity."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:21.611Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4d80d4fa986c5da99042b66bf30a028e7f564156"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee"
        }
      ],
      "title": "wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38600",
    "datePublished": "2025-08-19T17:03:34.830Z",
    "dateReserved": "2025-04-16T04:51:24.028Z",
    "dateUpdated": "2026-08-05T12:03:21.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38600",
      "date": "2026-08-09",
      "epss": "0.00178",
      "percentile": "0.07501"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38600\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:38.080\",\"lastModified\":\"2026-07-30T06:23:29.983\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()\\n\\nThe ssid-\u003essids[] and sreq-\u003essids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS\\nelements so this \u003e= needs to be \u003e to prevent an out of bounds access.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mt76: mt7925: correcci\u00f3n de uno en mt7925_mcu_hw_scan() Las matrices ssid-\u0026gt;ssids[] y sreq-\u0026gt;ssids[] tienen elementos MT7925_RNR_SCAN_MAX_BSSIDS, por lo que esto \u0026gt;= debe ser \u0026gt; para evitar un acceso fuera de los l\u00edmites.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8284815ca161e0fa0861cc4085f1c0141e10a34d\",\"lessThan\":\"4d80d4fa986c5da99042b66bf30a028e7f564156\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8284815ca161e0fa0861cc4085f1c0141e10a34d\",\"lessThan\":\"b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.1\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6BFC4F7-7099-4420-AF39-DD1CEABB8DF9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4d80d4fa986c5da99042b66bf30a028e7f564156\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:26:29+00:00",
      "cve": "CVE-2025-38600",
      "id": "CVE-2025-38600",
      "initial_release_date": "2025-08-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38600.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-12T03:44:53Z",
      "cve": "CVE-2025-38600",
      "id": "CVE-2025-38600",
      "initial_release_date": "2025-08-19T23:23:07Z",
      "product_status:known_not_affected": "345",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38600",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38600.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.