CVE-2025-68729: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68729 is a vulnerability in the Linux kernel's ath12k Wi-Fi driver affecting the RX error handling path for Qualcomm Wi-Fi 7 (802.11be) chipsets. The flaw was disclosed on December 24, 2025, and stems from improper handling of MSDU buffer type packets received on the REO exception ring from unassociated peers. The driver incorrectly expects link descriptor type packets; while these mismatched packets are not processed further, the associated socket buffer (skb) is never freed, potentially leading to kernel crashes and memory buffer leaks. Affected Linux kernel versions include those from commit d889913205cf up to the patched commits in stable branches, with fixes backported to kernel versions 6.17.13, 6.18.2, and 6.19-rc1. Feedly estimates this as a Medium severity issue with an EPSS score of 0.00017 (Feedly, ENISA EUVD).

The root cause is improper resource management (CWE-401 — Missing Release of Memory after Effective Lifetime) in the ath12k driver's RX error handler. When packets from unassociated peers arrive on the REO (Reorder) exception ring, they carry an MSDU (MAC Service Data Unit) buffer type descriptor rather than the expected link descriptor type. The function ath12k_hal_desc_reo_parse_err() returns early upon detecting the type mismatch, but the code path fails to call dev_kfree_skb_any() or equivalent to release the associated skb, resulting in a memory leak and potential kernel crash under sustained traffic conditions. The fix explicitly drops MSDU buffer type packets in the RX error handler before any further processing. This was tested on QCN9274 hw2.0 PCI with firmware WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (Feedly, ENISA EUVD).

Successful triggering of this vulnerability can cause kernel crashes (system instability or denial of service) and persistent memory buffer leaks on systems using Qualcomm ath12k-based Wi-Fi 7 adapters. An attacker in wireless proximity who sends crafted packets from an unassociated peer state could repeatedly trigger the leak, degrading system performance or causing an outright kernel panic. There is no evidence of confidentiality or integrity impact beyond availability loss (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in stable branches. Users should update to kernel version 6.17.13, 6.18.2, or 6.19-rc1 (or later), which include the fix commits 5ff5a9d71cdc, ab0554f51e5f, and 36f9edbb9d0f respectively. As a workaround where patching is not immediately possible, disabling or removing the ath12k Wi-Fi driver module on affected systems will prevent exploitation, though this also disables Wi-Fi functionality. Distribution-specific kernel updates from vendors such as Ubuntu, Debian, Red Hat, and SUSE should be monitored and applied promptly (ENISA EUVD, Feedly).