CVE-2025-39750

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Correct tid cleanup when tid setup fails

Currently, if any error occurs during ath12k_dp_rx_peer_tid_setup(), the tid value is already incremented, even though the corresponding TID is not actually allocated. Proceed to ath12k_dp_rx_peer_tid_delete() starting from unallocated tid, which might leads to freeing unallocated TID and cause potential crash or out-of-bounds access.

Hence, fix by correctly decrementing tid before cleanup to match only the successfully allocated TIDs.

Also, remove tid-- from failure case of ath12k_dp_rx_peer_frag_setup(), as decrementing the tid before cleanup in loop will take care of this.

Compile tested only.

This vulnerability primarily impacts availability, as triggering it can result in a kernel panic and a denial of service. Confidentiality is not impacted as there is no sensitive data being handled or exposed; similarly, integrity could potentially be impacted, but if so, is limited to driver-internal data structures.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.