CVE-2025-29338

CVE-2025-29338 — Security Advisory Buffer Overflow in NXP moal.ko Wi-Fi Kernel Driver woalsetupmoduleparam / parsecfggetline Field| Value ---|--- CVE ID| CVE-2025-29338 Severity| High CVSS v3.1 Score| 7.8 CVSS v3.1 Vector| CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Vulnerability Type| Stack-Bas...

CVE-2026-98830

A flaw was found in the Linux kernel's Silicon Labs WFx Wi-Fi driver. The driver fails to validate the length of firmware responses during Management Information Base MIB queries before copying the data into memory buffers. A compromised or malicious wireless device could supply an oversized...

CVE-2026-90355

A flaw was found in the Wi-Fi driver mt76: mt7996 of the Linux kernel. After a full chip reset, the driver fails to properly clear stale link state information, causing the device to become inoperative. This issue arises because the system attempts to re-create device and station records while ol...

CVE-2026-93094

A flaw was found in the ath12k Wi-Fi driver of the Linux kernel. This vulnerability occurs during the rollback of an Access Point AP virtual device vdev creation. If a peer creation step fails, the system can improperly free memory while still holding references to it, leading to a use-after-free...

CVE-2026-92497

A flaw was found in the ath12k Wi-Fi driver within the Linux kernel. This vulnerability occurs because the firmware buffer is read without first verifying that it contains enough data to hold a header. An attacker could potentially exploit this to cause a buffer overread, which may lead to...

CVE-2026-92498

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. Insufficient length checks in several Wireless Management Interface WMI event handlers, specifically ath6klwmiscancompleterx, ath6klwmiaddbareqeventrx, and ath6klwmidelbareqeventrx, allow the system to read beyond the allocated buffer...

CVE-2026-92496

A flaw was found in the ath11k Wi-Fi driver in the Linux kernel. This vulnerability allows a buffer overread to occur in the ath11kwmitlvoprx function. The driver reads the firmware buffer without adequately verifying its size, which could lead to reading data beyond the allocated memory. This...

CVE-2026-90408

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This vulnerability arises from insufficient length enforcement for event structures and unchecked firmware input used as loop bounds. An attacker could potentially exploit this to cause an out-of-bounds read, which may lead to informatio...

CVE-2026-90399

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This vulnerability stems from incorrect memory handling within the macphycapsparse function. When processing certain data packets from firmware, specifically short Type-Length-Value TLV structures, the driver attempts to write more data...

CVE-2026-90398

A flaw was found in the Linux kernel ath11k Wi-Fi driver. This vulnerability occurs in the macphycapsparse function due to a mismatch between the allocated memory size and the size used for copying data. When processing certain firmware messages, the driver attempts to write information beyond th...

CVE-2026-90382

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. When operating in monitor mode with the fcsfail filter enabled, a remote attacker could send corrupted wireless frames. These frames, if reporting an invalid length, would trigger a kernel warning. If the system is configured to panic on...

CVE-2026-90380

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. A use-after-free vulnerability occurs due to a race condition in the mt76rxpollcomplete function. This can happen when a Wi-Fi station STA is removed, but the system still attempts to access its associated wireless client ID wcid. An...

CVE-2026-90379

A flaw was found in the Linux kernel's Wi-Fi driver mt76. This vulnerability occurs when a PCIe Advanced Error Reporting AER error causes the bus to become unresponsive. The driver then attempts to read registers, receiving an invalid value that corrupts its internal memory management. This...

CVE-2026-90377

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This issue affects the Receive Reorder Offload RRO 3.0 data queuing mechanism. Incorrect handling of received data frames can cause them to stall and be reordered within the driver. This can lead to a denial of service or data integrity...

CVE-2026-90376

A flaw was found in the MediaTek mt76 Wi-Fi driver within the Linux kernel. An incorrect Multi-Link Device MLD ID in the MAC Transmit Descriptor TXD and Host Interface Transmit Packet HIF TXP can cause the firmware to enter a busy loop. This issue occurs when a third MLD link is in power saving...

CVE-2026-90371

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability is a race condition that occurs during the recycling of RXDMADC buffers. These buffers are associated with different Network Adapter Programming Interface NAPI instances, and a direct recycling method can lead to a timin...

CVE-2026-90369

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. The mt76mmiowritecopy and mt76mmioreadcopy functions, which handle memory-mapped I/O MMIO operations, can perform out-of-bounds reads or writes. This occurs when the data length is not a multiple of four, leading to memory access beyond th...

CVE-2026-90368

A flaw was found in the Wi-Fi driver mt76: mt7915 of the Linux kernel. Improper error handling during the addition of a new Wi-Fi interface can lead to the permanent leakage of system resources and a stale pointer dereference. This vulnerability could allow a local attacker to cause system...

CVE-2026-90367

A flaw was found in the Linux kernel's mt7996 Wi-Fi driver. The driver fails to properly hold a mutex, which is a mechanism to prevent simultaneous access to shared resources, when disabling a transmit worker during System Error Recovery SER. This oversight creates a race condition where a...

CVE-2026-90365

A flaw was found in the mt76 Wi-Fi driver in the Linux kernel. During device unregistration, certain work items resetwork and rcwork were not properly cancelled. This oversight could allow these work items to execute on an unregistered hardware, potentially leading to unexpected behavior, resourc...