CVE-2025-38343

What it actually does

The flaw allows IEEE 802.11 fragments carrying multicast or broadcast receiver addresses to be processed instead of being dropped, violating the unicast-only rule for fragmentation and enabling attacks similar to CVE-2020-26145.

Why it matters to the business

Unpatched Linux systems with mt7996 Wi-Fi hardware remain exposed to wireless frame-injection attacks that could lead to traffic manipulation or denial of service on affected networks; high downstream usage of the kernel increases patch urgency across fleets.

How an attack unfolds

An attacker sends crafted 802.11 fragments addressed to multicast or broadcast receivers; the driver previously accepted them, allowing reassembly that bypasses normal frame validation and can be leveraged for further wireless attacks.

How to fix it

Upgrade to fixed kernel versions: linux-lts (Alpaquita:23) 6.1.81-r0, linux-lts (Alpaquita:stream) 6.6.58-r0 or 6.12.41-r0, or mainline commit 24900688ee47071aa6a61e78473999b5b80f0423. Rebuild and reboot systems after applying the update.

How to confirm the fix worked

Confirm kernel version matches a listed fixed release, verify the mt76/mt7996 driver contains the RA check for fragments, and test that multicast/broadcast fragments are now dropped.

Typical attack path

1. Position within Wi-Fi range of target mt7996 device
2. Transmit 802.11 fragments with multicast or broadcast RA
3. Driver accepts and processes fragments instead of dropping them
4. Reassembled frames enable injection or other follow-on wireless attacks

How to detect it

Review wireless driver logs and 802.11 frame captures for any accepted fragments with multicast or broadcast receiver addresses prior to the patch; correlate with kernel version and mt76 driver activity.

What your security team should do

• Apply the listed kernel updates immediately on all affected linux-lts deployments
• Prioritize systems with mt7996 Wi-Fi hardware in external or guest networks
• Monitor EPSS trend and any new exploit maturity indicators for follow-up scanning