Kernel memory corruption via off-by-one SSID indexing
Published Aug 19, 2025 · Updated Aug 5, 2026
Out-of-bounds access in Linux 6.16 allows physically proximate attackers to corrupt kernel memory via crafted Wi-Fi scan data. The mt7925_mcu_hw_scan function permits index MT7925_RNR_SCAN_MAX_BSSIDS because its loop stops only above the limit, then accesses the fixed ssid->ssids and sreq->ssids arrays beyond their last valid element. Exploitation requires a system using the mt7925 Wi-Fi driver to process attacker-controlled Reduced Neighbor Report data from nearby 802.11 beacons or probe responses.
Summary
What happened
Out-of-bounds access in Linux 6.16 allows physically proximate attackers to corrupt kernel memory via crafted Wi-Fi scan data. The mt7925_mcu_hw_scan function permits index MT7925_RNR_SCAN_MAX_BSSIDS because its loop stops only above the limit, then accesses the fixed ssid->ssids and sreq->ssids arrays beyond their last valid element. Exploitation requires a system using the mt7925 Wi-Fi driver to process attacker-controlled Reduced Neighbor Report data from nearby 802.11 beacons or probe responses.
The record
- CVE
- CVE-2025-38600
- Published
- Aug 19, 2025
- Updated
- Aug 5, 2026
- Vendor
- The Linux Kernel Organization
- Product
- Linux
- Classifications
- CWE-193
- Attack vector
- adjacent
- Privileges
- unauthenticated
Timeline
How it unfolded
- Aug 19, 2025CVE publishedPublication date reported by the CVE source.
- Aug 5, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=6.16
- Affected versionversion=8284815ca161e0fa0861cc4085f1c0141e10a34d <4d80d4fa986c5da99042b66bf30a028e7f564156
- Affected versionversion=8284815ca161e0fa0861cc4085f1c0141e10a34d <b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo