CVE-2025-39761

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Decrement TID on RX peer frag setup error handling

Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to out-of-bounds access in peer->rx_tid[].

Hence, add a decrement operation for TID, before peer cleanup to ensures proper cleanup and prevents out-of-bounds access issues when the RX peer frag setup fails.

Found during code review. Compile tested only.

This flaw is rated as a Moderate impact for Red Hat Enterprise Linux because exploitation is constrained to systems with specific Qualcomm Wi-Fi adapters installed and actively utilizing the ath12k driver. The out-of-bounds memory access occurs solely during an error condition while preparing fragmented network frames, requiring adjacent network communication or manipulated wireless traffic to trigger. While this condition can lead to a kernel crash causing a denial of service or potential information leak, it cannot be leveraged for arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.