CVE-2025-38450
NoneCVSS
—
EPSS
0.2%
Published
Jul 25, 2025
CISA due date
—
Cloudanix analysis
A bug in certain Linux WiFi hardware drivers can make the computer crash when setting up wireless connections in access-point mode.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
NULL pointer dereference in mt7925_sta_set_decap_offload when msta->vif or wcid.sta is uninitialized, causing a kernel paging fault and panic during station state transitions in AP mode.
Why it matters to the business
Systems using mt7925 WiFi hardware in access-point configurations may experience unexpected kernel crashes that interrupt wireless services and require reboots, with higher urgency for any deployments still on pre-fix kernels given the published fix date and downstream package availability.
How an attack unfolds
An attacker with local access or the ability to trigger nl80211 station addition (such as via hostapd or a malicious client association sequence) can cause the driver to invoke mt7925_sta_set_decap_offload before the station structure is fully populated, dereferencing a NULL vif pointer and crashing the kernel.
How to fix it
Update the Linux kernel to commit 9b50874f297fcc62adc7396f35209878e51010b0 or later; for Debian packages upgrade webkit2gtk and wpewebkit to the versions listed as 2.48.5-1 (or 2.48.5-1~deb12u1 / 2.48.5-1~deb13u1) depending on the release.
How to confirm the fix worked
Confirm the running kernel contains commit 9b50874f297fcc62adc7396f35209878e51010b0, verify mt7925_common module no longer contains the vulnerable mt7925_sta_set_decap_offload path, and test station addition under AP mode without observing the NULL dereference panic.
Typical attack path
- Obtain local execution or network-adjacent position capable of sending nl80211 messages
- Trigger ieee80211_add_station or sta_apply_parameters before the station is fully initialized
- Cause mt7925_sta_set_decap_offload to be called with msta->vif set to NULL
- Induce kernel page fault and panic
How to detect it
Search kernel logs for the exact call trace involving mt7925_sta_set_decap_offload, ieee80211_check_fast_rx, and sta_info_move_state; correlate with hostapd or nl80211 activity around the crash timestamp.
What your security team should do
- Prioritize kernel updates on any mt7925-based AP deployments within the next maintenance window
- Monitor for kernel oops or panic logs containing mt7925_sta_set_decap_offload and ieee80211_check_fast_rx
- Restrict untrusted local users or processes from issuing nl80211 station management commands until patched
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() Add a NULL check for msta->vif before accessing its members to prevent a kernel panic in AP mode deployment. This also fix the issue reported in [1]. The crash occurs when this function is triggered before the station is fully initialized. The call trace shows a page fault at mt7925_sta_set_decap_offload() due to accessing resources when msta->vif is NULL. Fix this by adding an early return if msta->vif is NULL and also check wcid.sta is ready. This ensures we only proceed with decap offload configuration when the station's state is properly initialized. [14739.655703] Unable to handle kernel paging request at virtual address ffffffffffffffa0 [14739.811820] CPU: 0 UID: 0 PID: 895854 Comm: hostapd Tainted: G [14739.821394] Tainted: [C]=CRAP, [O]=OOT_MODULE [14739.825746] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) [14739.831577] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [14739.838538] pc : mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.845271] lr : mt7925_sta_set_decap_offload+0x58/0x1b8 [mt7925_common] [14739.851985] sp : ffffffc085efb500 [14739.855295] x29: ffffffc085efb500 x28: 0000000000000000 x27: ffffff807803a158 [14739.862436] x26: ffffff8041ececb8 x25: 0000000000000001 x24: 0000000000000001 [14739.869577] x23: 0000000000000001 x22: 0000000000000008 x21: ffffff8041ecea88 [14739.876715] x20: ffffff8041c19ca0 x19: ffffff8078031fe0 x18: 0000000000000000 [14739.883853] x17: 0000000000000000 x16: ffffffe2aeac1110 x15: 000000559da48080 [14739.890991] x14: 0000000000000001 x13: 0000000000000000 x12: 0000000000000000 [14739.898130] x11: 0a10020001008e88 x10: 0000000000001a50 x9 : ffffffe26457bfa0 [14739.905269] x8 : ffffff8042013bb0 x7 : ffffff807fb6cbf8 x6 : dead000000000100 [14739.912407] x5 : dead000000000122 x4 : ffffff80780326c8 x3 : 0000000000000000 [14739.919546] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8041ececb8 [14739.926686] Call trace: [14739.929130] mt7925_sta_set_decap_offload+0xc0/0x1b8 [mt7925_common] [14739.935505] ieee80211_check_fast_rx+0x19c/0x510 [mac80211] [14739.941344] _sta_info_move_state+0xe4/0x510 [mac80211] [14739.946860] sta_info_move_state+0x1c/0x30 [mac80211] [14739.952116] sta_apply_auth_flags.constprop.0+0x90/0x1b0 [mac80211] [14739.958708] sta_apply_parameters+0x234/0x5e0 [mac80211] [14739.964332] ieee80211_add_station+0xdc/0x190 [mac80211] [14739.969950] nl80211_new_station+0x46c/0x670 [cfg80211] [14739.975516] genl_family_rcv_msg_doit+0xdc/0x150 [14739.980158] genl_rcv_msg+0x218/0x298 [14739.983830] netlink_rcv_skb+0x64/0x138 [14739.987670] genl_rcv+0x40/0x60 [14739.990816] netlink_unicast+0x314/0x380 [14739.994742] netlink_sendmsg+0x198/0x3f0 [14739.998664] __sock_sendmsg+0x64/0xc0 [14740.002324] ____sys_sendmsg+0x260/0x298 [14740.006242] ___sys_sendmsg+0xb4/0x110
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:13 | linux | 0 | 6.12.41-1 |
| Debian:14 | linux | 0 | No fix |
| Debian:14 | linux | 0 | 6.16.3-1 |
| Linux | Kernel | 6.11.0 | 6.12.39 |
| openSUSE:Leap 16.0 | dtb-aarch64 | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-64kb | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-default | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-default-base | 0 | 6.12.0-160000.6.1.160000.2.4 |
| openSUSE:Leap 16.0 | kernel-docs | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-kvmsmall | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-obs-build | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-obs-qa | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-rt | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-source | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-syms | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-zfcpdump | 0 | 6.12.0-160000.6.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39884 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix subvolume… Also affects linux
- CVE-2025-39886 In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39880 In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid… Also affects linux
- CVE-2025-39881 In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in… Also affects linux
- CVE-2025-39882 In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix… Also affects linux