CVE-2025-38343 (GCVE-0-2025-38343)

Vulnerability from cvelistv5 – Published: 2025-07-10 08:15 – Updated: 2026-08-05 12:01
VLAI
Title
wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: drop fragments with multicast or broadcast RA IEEE 802.11 fragmentation can only be applied to unicast frames. Therefore, drop fragments with multicast or broadcast RA. This patch addresses vulnerabilities such as CVE-2020-26145.
Severity
8.3 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 24900688ee47071aa6a61e78473999b5b80f0423 (git)
Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < d4b93f9c2f666011dcf810050ef60a6b8d06f186 (git)
Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 5fd5b8132b5de08c99eea003f7715ff2e361b007 (git)
Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 80fda1cd7b0a1edd0849dc71403a070d0922118d (git)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24900688ee47071aa6a61e78473999b5b80f0423",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "d4b93f9c2f666011dcf810050ef60a6b8d06f186",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "5fd5b8132b5de08c99eea003f7715ff2e361b007",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "80fda1cd7b0a1edd0849dc71403a070d0922118d",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: drop fragments with multicast or broadcast RA\n\nIEEE 802.11 fragmentation can only be applied to unicast frames.\nTherefore, drop fragments with multicast or broadcast RA. This patch\naddresses vulnerabilities such as CVE-2020-26145."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Exploitation requires injecting a crafted 802.11 frame that the victim\u0027s mt7996 radio receives, so the attacker must be within Wi-Fi range on the same radio segment. This matches the standard adjacent-network vector used for WiFi frame-injection bugs.\nAC:L - The attacker simply transmits a frame with a group-addressed RA and the more-fragments bit or a non-zero fragment number set, spoofing the AP\u0027s transmitter address; the missing validation is deterministic with no race, timing window, or memory-layout condition involved. Hardware RX decap offload is enabled unconditionally by mt7996 at start, so the vulnerable 802.3 fast path is the default configuration.\nPR:N - The attacker never associates, authenticates, or holds any WLAN credential \u2014 the injected frame is plaintext and is accepted because __ieee80211_rx_handle_8023() performs no protection check. The only prerequisite is that the victim is in its normal associated/authorized state.\nUI:N - The victim only needs to be connected to its WLAN, which is its ordinary operating state; the forged fragment is processed automatically in the RX path. No click, mount, or other user action is required.\nS:U - The forged frame is delivered into the same host\u0027s network stack under the same kernel security authority, and no VM, IOMMU, or sandbox boundary is crossed. Consistent with how other WiFi RX-path issues in this subsystem are scored.\nC:H - The primitive is arbitrary plaintext frame injection into an encrypted WLAN, and the documented exploitation of exactly this class (Vanhoef\u0027s FragAttacks demo for CVE-2020-26145, which the commit cites) is injecting an ICMPv6 Router Advertisement or DHCP response \u2014 accepted by default on Linux/Android \u2014 that installs an attacker-controlled router and DNS server, redirecting the victim\u0027s traffic to attacker infrastructure for full interception.\nI:H - The vulnerability defeats WPA2/WPA3 link-layer integrity: an unauthenticated attacker\u0027s forged data is accepted and processed as if it came authenticated from the AP, and in AP mode ieee80211_rx_8023()\u0027s internal_forward path relays multicast-DA injections onward to the rest of the BSS. This is unrestricted injection of attacker-chosen network data, which NVD likewise scores I:H for CVE-2020-26145.\nA:L - The same injection primitive lets the attacker disrupt the victim\u0027s connectivity \u2014 forged TCP RSTs, or a rogue RA that blackholes the default route \u2014 degrading network service. There is no kernel crash, hang, or resource exhaustion, so the loss is partial rather than total."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:15.969Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24900688ee47071aa6a61e78473999b5b80f0423"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4b93f9c2f666011dcf810050ef60a6b8d06f186"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fd5b8132b5de08c99eea003f7715ff2e361b007"
        },
        {
          "url": "https://git.kernel.org/stable/c/80fda1cd7b0a1edd0849dc71403a070d0922118d"
        }
      ],
      "title": "wifi: mt76: mt7996: drop fragments with multicast or broadcast RA",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38343",
    "datePublished": "2025-07-10T08:15:12.154Z",
    "dateReserved": "2025-04-16T04:51:24.005Z",
    "dateUpdated": "2026-08-05T12:01:15.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38343",
      "date": "2026-08-10",
      "epss": "0.00211",
      "percentile": "0.1147"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T15:06:54.000Z",
      "cve": "CVE-2025-38343",
      "id": "msrc_CVE-2025-38343",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: mt76: mt7996: drop fragments with multicast or broadcast RA",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38343.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38343\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T09:15:29.157\",\"lastModified\":\"2026-07-30T06:23:08.107\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7996: drop fragments with multicast or broadcast RA\\n\\nIEEE 802.11 fragmentation can only be applied to unicast frames.\\nTherefore, drop fragments with multicast or broadcast RA. This patch\\naddresses vulnerabilities such as CVE-2020-26145.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mt76: mt7996: la eliminaci\u00f3n de fragmentos con RA de multidifusi\u00f3n o difusi\u00f3n. La fragmentaci\u00f3n IEEE 802.11 solo se puede aplicar a tramas de unidifusi\u00f3n. Por lo tanto, se deben eliminar fragmentos con RA de multidifusi\u00f3n o difusi\u00f3n. Este parche corrige vulnerabilidades como CVE-2020-26145.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"98686cd21624c75a043e96812beadddf4f6f48e5\",\"lessThan\":\"24900688ee47071aa6a61e78473999b5b80f0423\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98686cd21624c75a043e96812beadddf4f6f48e5\",\"lessThan\":\"d4b93f9c2f666011dcf810050ef60a6b8d06f186\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98686cd21624c75a043e96812beadddf4f6f48e5\",\"lessThan\":\"5fd5b8132b5de08c99eea003f7715ff2e361b007\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98686cd21624c75a043e96812beadddf4f6f48e5\",\"lessThan\":\"80fda1cd7b0a1edd0849dc71403a070d0922118d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.95\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.35\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.95\",\"matchCriteriaId\":\"C5E01853-7048-4D78-9479-9AEE41AC8456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"E569FD34-0076-4428-BE17-EECCF867611C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24900688ee47071aa6a61e78473999b5b80f0423\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5fd5b8132b5de08c99eea003f7715ff2e361b007\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/80fda1cd7b0a1edd0849dc71403a070d0922118d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d4b93f9c2f666011dcf810050ef60a6b8d06f186\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:32:37+00:00",
      "cve": "CVE-2025-38343",
      "id": "CVE-2025-38343",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: mt7996: drop fragments with multicast or broadcast RA",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38343.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-17T13:10:37Z",
      "cve": "CVE-2025-38343",
      "id": "CVE-2025-38343",
      "initial_release_date": "2025-07-14T23:22:16Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "333",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38343",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38343.json",
      "version": "40"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.