CVE-2025-68380: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68380 is a firmware crash vulnerability in the Linux kernel's ath11k Wi-Fi driver caused by incorrect HE (High Efficiency) MCS (Modulation and Coding Scheme) assignment. In ath11k_wmi_send_peer_assoc_cmd(), the peer's transmit and receive MCS values are swapped when sent to firmware, contrary to the firmware's expected definitions. When connecting to a misbehaved access point that advertises 0xffff (meaning "not supported") for the 160 MHz transmit MCS map, the firmware crashes because 0xffff is incorrectly assigned to the he_mcs->rx_mcs_set field. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from commit 61fe43e7216d onward until the respective stable fixes. No CVSS score has been assigned by NVD at this time; the ENISA base score is listed as 0.0, and the EPSS score is approximately 0.018% (Feedly, ENISA EUVD).

The root cause is an incorrect field assignment (CWE-682: Incorrect Calculation / logic error) in the ath11k_wmi_send_peer_assoc_cmd() function within the Linux kernel's ath11k Wi-Fi driver. Specifically, the peer's transmit MCS is sent to firmware as receive MCS and vice versa, violating the firmware's API contract. When a malformed or misbehaved AP advertises 0xffff for its 160 MHz Tx HE-MCS map — a value indicating "not supported" — this value is incorrectly placed into the he_mcs->rx_mcs_set field, triggering a firmware crash. The fix involves swapping the MCS assignments and adjusting the HE rate control mask to correctly apply to the peer's receive MCS via he_mcs->rx_mcs_set. The fix has been tested on WCN6855 hw2.1 and QCN9274 hw2.0 hardware (Feedly).

The primary impact is an availability loss: a Linux system using an ath11k-based Wi-Fi adapter (such as WCN6855 or QCN9274) can have its wireless firmware crash when associating with a malicious or misconfigured access point that advertises an unsupported (0xffff) 160 MHz Tx HE-MCS map. This results in a denial-of-service condition for the wireless interface, potentially requiring a driver or system restart to recover. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability of the Wi-Fi subsystem (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-68380. The vulnerability requires proximity to the victim (the attacker must control or operate a Wi-Fi access point that the victim connects to) and is therefore not remotely exploitable over the internet. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The Linux kernel stable trees have been patched with fixes backported to multiple stable branches. Patched versions include Linux 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1, as well as Debian's linux 6.1.162-1 (oldstable/LTS). Ubuntu has issued security notices USN-8179-1, USN-8179-2, USN-8179-3, USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, and USN-8265-1 addressing this and related kernel vulnerabilities. Users should update their Linux kernel to a patched version as provided by their distribution. As a temporary workaround, avoiding connection to untrusted or unknown Wi-Fi access points using ath11k-based adapters can reduce exposure (Feedly, Ubuntu USN-8179-1, Debian LTS).