CVE-2025-68380

What it actually does

Incorrect swapping of peer transmit and receive HE MCS values in ath11k_wmi_send_peer_assoc_cmd() causes the driver to forward an unsupported 0xffff MCS map into the firmware's rx_mcs_set field, triggering a crash during peer association with 160 MHz APs.

Why it matters to the business

Wireless connectivity on affected Linux systems can be disrupted by nearby access points advertising unsupported MCS maps, leading to hardware resets, dropped connections, and potential denial of service for Wi-Fi dependent operations.

How an attack unfolds

An attacker positions a misconfigured or malicious Wi-Fi access point that advertises 0xffff in the 160 MHz Tx HE-MCS map. When a vulnerable client attempts association, the swapped MCS values are passed to firmware, which crashes on the invalid assignment.

How to fix it

Apply the upstream fix that swaps the MCS assignment and routes the HE rate control mask through the correct rx_mcs_set field. Update to a kernel containing commit 92791290e4f6a1de25d35af792ab8918a70737f6 or later equivalent stable release.

How to confirm the fix worked

Confirm the patched driver source contains the corrected MCS assignment logic in ath11k_wmi_send_peer_assoc_cmd(); test association against an AP advertising 0xffff 160 MHz Tx MCS map and verify the interface remains stable without firmware crashes.

Typical attack path

1. Attacker deploys or compromises an AP advertising unsupported 160 MHz Tx HE-MCS map (0xffff)
2. Vulnerable client initiates connection and sends peer association command
3. Driver incorrectly maps Tx MCS into firmware rx_mcs_set field
4. Firmware encounters invalid value and crashes, disrupting the wireless interface

How to detect it

Review kernel and ath11k driver logs for firmware crash or reset events immediately following Wi-Fi association attempts; inspect beacon frames from nearby APs for 160 MHz HE MCS maps set to 0xffff.

What your security team should do

• Prioritize kernel updates containing the MCS swap fix on all systems using ath11k hardware
• Monitor for firmware crash events on wireless interfaces during AP association
• Temporarily restrict connections to known trusted APs until patches are deployed