CVE-2025-39750: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39750 is a vulnerability in the Linux kernel's ath12k WiFi driver caused by improper TID (Traffic Identification) cleanup when peer TID setup fails. When an error occurs during ath12k_dp_rx_peer_tid_setup(), the TID counter is incorrectly incremented even though the corresponding TID was never allocated, leading to potential out-of-bounds memory access or system crash during subsequent cleanup. The vulnerability affects Linux kernel versions 6.3–6.6.102, 6.7–6.12.42, 6.13–6.15.10, and 6.16–6.16.1. It was published on September 11, 2025, with patches committed to the kernel git repository on November 25, 2025. The CVSS v3.1 base score is 7.1 (High) (Feedly, Microsoft MSRC).

The root cause is classified as CWE-125 (Out-of-bounds Read). In ath12k_dp_rx_peer_tid_setup(), when an error occurs mid-loop, the tid variable has already been incremented to point to the next (unallocated) TID. The subsequent call to ath12k_dp_rx_peer_tid_delete() then begins cleanup from this unallocated TID index, potentially reading or freeing memory that was never properly initialized. The fix involves correctly decrementing tid before the cleanup loop to ensure only successfully allocated TIDs are cleaned up, and removing a redundant tid-- from the failure path of ath12k_dp_rx_peer_frag_setup(). The attack vector is local, requiring low privileges and no user interaction (Feedly, Kernel Patch).

Successful exploitation could allow a local attacker with low privileges to trigger a kernel crash (denial of service) or perform unauthorized out-of-bounds memory reads, potentially exposing sensitive kernel memory contents. The vulnerability affects confidentiality and availability (both rated High), but has no direct integrity impact. Systems running WiFi-enabled Linux kernels with the ath12k driver loaded are at risk, which includes devices using Qualcomm Wi-Fi 7 chipsets (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with at least low-privilege credentials, limiting the attack surface (Feedly).

Update to a patched Linux kernel version: 6.6.103 or later (for the 6.6.x branch), 6.12.43 or later (for the 6.12.x branch), 6.15.11 or later (for the 6.15.x branch), or 6.16.2 or later (for the 6.16.x branch). Patches were committed to the Linux kernel stable repository on November 25, 2025. For systems that cannot be immediately patched, consider restricting local user access, disabling the ath12k WiFi driver if it is not operationally required, and monitoring for unusual kernel crash or oops messages (Feedly, Kernel Patch).