CVE-2025-39862

What it actually does

Failure to clear WCID station lists before ieee80211_restart_hw allows stale list entries to remain, leading to list corruption when stations are recreated.

Why it matters to the business

Linux systems using MT7915 WiFi hardware may experience kernel instability, crashes, or loss of wireless connectivity after hardware restarts, increasing downtime for affected devices.

How an attack unfolds

An attacker triggers conditions that cause a hardware restart in the mt7915 driver; because lists are not cleared and wcid->sta is not zeroed, subsequent station addition corrupts internal lists, potentially leading to memory corruption or denial of service.

How to fix it

Update the Linux kernel to the commit 8fa8eb52bc2eb08d93202863b5fc478e0bebc00c or later stable releases containing the fix; ensure all mt76/mt7915 userspace and driver components are rebuilt against the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 8fa8eb52bc2eb08d93202863b5fc478e0bebc00c via git log or kernel version string; test hardware restart scenarios under load to confirm absence of list corruption warnings.

Typical attack path

1. Trigger hardware restart path in mt76/mt7915 driver
2. Exploit uncleared WCID lists and non-zeroed sta pointers
3. Cause list corruption during station recreation
4. Escalate to kernel panic or memory corruption

How to detect it

Search kernel logs and dmesg for mt76, mt7915, list corruption, or ieee80211_restart_hw related warnings or oops messages around hardware restart events.

• list_add corruption
• mt7915
• ieee80211_restart_hw
• wcid->sta

What your security team should do

• Prioritize kernel upgrades on all systems using mt7915 hardware within the next maintenance window
• Monitor kernel logs for list corruption or mt76 restart errors until patches are applied
• Limit exposure by restricting hardware restart triggers where feasible