CVE-2025-39761

What it actually does

Failure to decrement TID before peer cleanup in ath12k_dp_rx_peer_frag_setup error path allows out-of-bounds access to peer->rx_tid[] array, resulting in memory corruption in the Linux kernel ath12k WiFi driver.

Why it matters to the business

May cause system instability, crashes, or exploitable memory issues in Linux-based wireless devices and servers; low urgency given no known active exploitation or ransomware use despite moderate ecosystem presence in kernel distributions.

How an attack unfolds

An attacker triggers an RX peer fragmentation setup failure in the ath12k driver, then leverages the missing TID decrement to perform out-of-bounds reads or writes on the rx_tid array; while threat actors such as VMSCAPE have been linked to related Linux kernel issues, no public exploit exists for this flaw.

How to fix it

Apply the upstream fix in commit eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6 or upgrade to a fixed kernel release; for affected Liferay BOM packages update to 2024.Q1.16 or 2025.Q1.6 as appropriate for the distribution.

How to confirm the fix worked

Verify the presence of the decrement operation in ath12k_dp_rx_peer_frag_setup after patching; confirm kernel build includes the fix and test error paths with fuzzing or targeted packet injection.

Typical attack path

1. Craft network traffic or conditions that cause ath12k_dp_rx_peer_frag_setup to enter its error handling path
2. Omit the required TID decrement before peer cleanup
3. Access or manipulate memory beyond the bounds of peer->rx_tid[]
4. Escalate to kernel crash, information leak, or arbitrary code execution if conditions allow

How to detect it

Review kernel logs and dmesg for ath12k OOB warnings, peer cleanup errors, or crashes referencing rx_tid; correlate with network activity that exercises fragmentation handling.

What your security team should do

• Prioritize kernel updates on all systems using ath12k WiFi hardware
• Monitor for related memory corruption reports in kernel logs
• Apply compensating controls such as disabling unnecessary WiFi interfaces until patched