CVE-2025-29338

CVE-2025-29338 — セキュリティ勧告 NXP moal.ko Wi-Fiカーネルドライバのバッファオーバーフロー（woalsetupmoduleparam / parsecfggetline） フィールド| 値 ---|--- CVE ID| CVE-2025-29338 深刻度| High CVSS v3.1スコア| 7.8 CVSS v3.1ベクター| CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 脆弱性タイプ| スタックベースのバッファオーバーフロー CWE-121 攻撃ベクトル| ローカル ベンダー| NXP...

CVE-2026-17054: Out-of-bounds Read

The Espressif ESP-hosted Wi-Fi driver drivers/wifi/esphosted/ parses frames received over SPI from the ESP co-processor in esphostedeventtask. For control frames it took the 16-bit TLV field datalength straight off the wire and passed it to pbistreamfrombufferframe.datavalue, frame.datalength...

kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash

A flaw was found in the ath9k Wi-Fi driver in the Linux kernel. A race condition exists during the asynchronous firmware loading process and device disconnection. A local attacker, by repeatedly connecting and disconnecting a malicious USB Wi-Fi device that fails firmware download, could trigger ...

Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

ALSA-2026:67468 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address CVE-2025-71127 kernel: KVM: nSVM: Always use vmcb01 in...

CVE-2026-80941

A flaw was found in the rtw88 Wi-Fi driver of the Linux kernel. This issue occurs because the rtwtxqpushskb function fails to free a socket buffer skb when an error occurs during transmission. This oversight can lead to a memory leak, potentially impacting system stability and performance over ti...

CVE-2026-80949

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. The memory allocated for a buffer is not properly released in certain error handling paths within the brcmfsdioreadcontrol function. This improper memory management can lead to a memory leak, potentially causing system instability or a...

CVE-2026-80937

A flaw was found in the Linux kernel's Wi-Fi driver for mt7915 chipsets. This vulnerability allows a malicious or malfunctioning Wi-Fi device to provide an invalid memory address. This can cause the driver to write data beyond its allocated memory, leading to an out-of-bounds write. Such memory...

CVE-2026-89523

A flaw was found in the Linux kernel's MediaTek mt7925 Wi-Fi driver. When the device is reset, suspended, or unregistered, a pending work item mlopmwork can continue to execute. This can lead to the work item accessing memory that has already been freed a use-after-free vulnerability or sending...

CVE-2026-80933

A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. This vulnerability occurs because the driver does not properly validate the size of the default EEPROM Electrically Erasable Programmable Read-Only Memory firmware. A specially crafted, truncated EEPROM firmware file can cause the...

CVE-2026-80944

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When a synchronous command's wait operation is interrupted, the driver can attempt to write data to a memory location that has already been released. This memory corruption can lead to a system crash kernel panic, resulting in a Denial ...

CVE-2026-80934

A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. The driver incorrectly manages Direct Memory Access DMA mappings when processing AddBA request frames, causing a continuous leak of these mappings. Over time, this resource exhaustion can lead to a Denial of Service DoS for the Wi-...

CVE-2026-80935

A flaw was found in the Linux kernel's Wi-Fi driver for MediaTek MT7996 devices. A malicious or malfunctioning Wi-Fi device can exploit improper validation of an EEPROM Electrically Erasable Programmable Read-Only Memory address during a copy operation. This can lead to an out-of-bounds write,...

kernel: wifi: mt76: mt7925: fix crash in reset link replay

A flaw was found in the MediaTek mt7925 Wi-Fi driver within the Linux kernel. During a reset recovery process, the driver can attempt to access a network configuration that no longer exists. This can lead to a null pointer dereference, causing the system to crash and resulting in a Denial of...

kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

A flaw was found in the Linux kernel. The mt7925 Wi-Fi driver incorrectly dispatches a memory-mapped I/O MMIO specific event to non-MMIO buses, such as USB. This improper handling leads to a NULL pointer dereference when attempting to clean up DMA transmit queues. A remote attacker could exploit...

CVE-2026-80632

A flaw was found in the Linux kernel's Wi-Fi driver, specifically within the mt7996 component. When the MT76NPU and CONFIGNETMEDIATEKSOCWED configurations are enabled and the Airoha NPU System-on-Chip SoC is detected, the mt7996inittxqueues function can attempt to dereference a NULL Wi-Fi/Etherne...

CVE-2026-80635

A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. This vulnerability occurs because the driver does not adequately validate the length of certain firmware responses. An attacker could potentially craft a malicious firmware response, leading to an out-of-bounds read of stale heap data...

CVE-2026-74648

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. This vulnerability occurs because the rtwcfg80211monitorifxmitentry function does not properly validate the length of monitor transmit frames after processing. A remote attacker could exploit this by sending a specially crafted,...

CVE-2026-12999

The Infineon Airoc Wi-Fi driver's transmit callback airocmgmtsend in drivers/wifi/infineon/airocwifi.c allocates a netbuf from the fixed airocpool for every outbound packet. When whdnetworksendethernetdata returns a synchronous failure, the underlying WHD library does not take ownership of the...

CVE-2026-12999 Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion

The Infineon Airoc Wi-Fi driver's transmit callback airocmgmtsend in drivers/wifi/infineon/airocwifi.c allocates a netbuf from the fixed airocpool for every outbound packet. When whdnetworksendethernetdata returns a synchronous failure, the underlying WHD library does not take ownership of the...