CVE-2025-38343

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38343", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.005Z", "datePublished": "2025-07-10T08:15:12.154Z", "dateUpdated": "2026-08-05T12:01:15.969Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:15.969Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: drop fragments with multicast or broadcast RA\n\nIEEE 802.11 fragmentation can only be applied to unicast frames.\nTherefore, drop fragments with multicast or broadcast RA. This patch\naddresses vulnerabilities such as CVE-2020-26145."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "baseScore": 8.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - Exploitation requires injecting a crafted 802.11 frame that the victim's mt7996 radio receives, so the attacker must be within Wi-Fi range on the same radio segment. This matches the standard adjacent-network vector used for WiFi frame-injection bugs.\nAC:L - The attacker simply transmits a frame with a group-addressed RA and the more-fragments bit or a non-zero fragment number set, spoofing the AP's transmitter address; the missing validation is deterministic with no race, timing window, or memory-layout condition involved. Hardware RX decap offload is enabled unconditionally by mt7996 at start, so the vulnerable 802.3 fast path is the default configuration.\nPR:N - The attacker never associates, authenticates, or holds any WLAN credential \u2014 the injected frame is plaintext and is accepted because __ieee80211_rx_handle_8023() performs no protection check. The only prerequisite is that the victim is in its normal associated/authorized state.\nUI:N - The victim only needs to be connected to its WLAN, which is its ordinary operating state; the forged fragment is processed automatically in the RX path. No click, mount, or other user action is required.\nS:U - The forged frame is delivered into the same host's network stack under the same kernel security authority, and no VM, IOMMU, or sandbox boundary is crossed. Consistent with how other WiFi RX-path issues in this subsystem are scored.\nC:H - The primitive is arbitrary plaintext frame injection into an encrypted WLAN, and the documented exploitation of exactly this class (Vanhoef's FragAttacks demo for CVE-2020-26145, which the commit cites) is injecting an ICMPv6 Router Advertisement or DHCP response \u2014 accepted by default on Linux/Android \u2014 that installs an attacker-controlled router and DNS server, redirecting the victim's traffic to attacker infrastructure for full interception.\nI:H - The vulnerability defeats WPA2/WPA3 link-layer integrity: an unauthenticated attacker's forged data is accepted and processed as if it came authenticated from the AP, and in AP mode ieee80211_rx_8023()'s internal_forward path relays multicast-DA injections onward to the rest of the BSS. This is unrestricted injection of attacker-chosen network data, which NVD likewise scores I:H for CVE-2020-26145.\nA:L - The same injection primitive lets the attacker disrupt the victim's connectivity \u2014 forged TCP RSTs, or a rogue RA that blackholes the default route \u2014 degrading network service. There is no kernel crash, hang, or resource exhaustion, so the loss is partial rather than total."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt7996/mac.c"], "versions": [{"version": "98686cd21624c75a043e96812beadddf4f6f48e5", "lessThan": "24900688ee47071aa6a61e78473999b5b80f0423", "status": "affected", "versionType": "git"}, {"version": "98686cd21624c75a043e96812beadddf4f6f48e5", "lessThan": "d4b93f9c2f666011dcf810050ef60a6b8d06f186", "status": "affected", "versionType": "git"}, {"version": "98686cd21624c75a043e96812beadddf4f6f48e5", "lessThan": "5fd5b8132b5de08c99eea003f7715ff2e361b007", "status": "affected", "versionType": "git"}, {"version": "98686cd21624c75a043e96812beadddf4f6f48e5", "lessThan": "80fda1cd7b0a1edd0849dc71403a070d0922118d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt7996/mac.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.15.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/24900688ee47071aa6a61e78473999b5b80f0423"}, {"url": "https://git.kernel.org/stable/c/d4b93f9c2f666011dcf810050ef60a6b8d06f186"}, {"url": "https://git.kernel.org/stable/c/5fd5b8132b5de08c99eea003f7715ff2e361b007"}, {"url": "https://git.kernel.org/stable/c/80fda1cd7b0a1edd0849dc71403a070d0922118d"}], "title": "wifi: mt76: mt7996: drop fragments with multicast or broadcast RA", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt7996/mac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "24900688ee47071aa6a61e78473999b5b80f0423", "status": "affected", "version": "98686cd21624c75a043e96812beadddf4f6f48e5", "versionType": "git"}, {"lessThan": "d4b93f9c2f666011dcf810050ef60a6b8d06f186", "status": "affected", "version": "98686cd21624c75a043e96812beadddf4f6f48e5", "versionType": "git"}, {"lessThan": "5fd5b8132b5de08c99eea003f7715ff2e361b007", "status": "affected", "version": "98686cd21624c75a043e96812beadddf4f6f48e5", "versionType": "git"}, {"lessThan": "80fda1cd7b0a1edd0849dc71403a070d0922118d", "status": "affected", "version": "98686cd21624c75a043e96812beadddf4f6f48e5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt7996/mac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.95", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.35", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5E01853-7048-4D78-9479-9AEE41AC8456", "versionEndExcluding": "6.6.95", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E569FD34-0076-4428-BE17-EECCF867611C", "versionEndExcluding": "6.12.35", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655", "versionEndExcluding": "6.15.4", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: drop fragments with multicast or broadcast RA\n\nIEEE 802.11 fragmentation can only be applied to unicast frames.\nTherefore, drop fragments with multicast or broadcast RA. This patch\naddresses vulnerabilities such as CVE-2020-26145."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mt76: mt7996: la eliminaci\u00f3n de fragmentos con RA de multidifusi\u00f3n o difusi\u00f3n. La fragmentaci\u00f3n IEEE 802.11 solo se puede aplicar a tramas de unidifusi\u00f3n. Por lo tanto, se deben eliminar fragmentos con RA de multidifusi\u00f3n o difusi\u00f3n. Este parche corrige vulnerabilidades como CVE-2020-26145."}], "id": "CVE-2025-38343", "lastModified": "2026-07-30T06:23:08.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-10T09:15:29.157", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/24900688ee47071aa6a61e78473999b5b80f0423"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5fd5b8132b5de08c99eea003f7715ff2e361b007"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/80fda1cd7b0a1edd0849dc71403a070d0922118d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d4b93f9c2f666011dcf810050ef60a6b8d06f186"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: mt76: mt7996: drop fragments with multicast or broadcast RA", "id": "2379260", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379260"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38343", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38343\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38343\nhttps://lore.kernel.org/linux-cve-announce/2025071035-CVE-2025-38343-9a3b@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:06:40.649620+00:00", "updated": "2025-07-13T11:06:40.649697+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}