CVE-2025-68380

Root

Cause In the Linux kernel's ath11k_wmi_send_peer_assoc_cmd(), the HE MCS fields were incorrectly swapped: the peer's transmit MCS was sent to firmware as receive MCS, and the peer's receive MCS as transmit MCS. This contradicts the firmware's expected definition. The fix corrects the assignment order and also ensures that the HE rate control mask (which limits the station's own transmit MCS) is applied to the peer's receive MCS field, as intended.

Exploitation

An attacker can trigger this bug by acting as a misconfigured or malicious AP that advertises an invalid 160 MHz transmit MCS map value of 0xffff (meaning "not supported"). When a station running a vulnerable ath11k driver associates with such an AP, the driver passes this invalid value into the firmware's he_mcs->rx_mcs_set field, causing the firmware to crash. No special privileges are required beyond the ability to influence an AP's HE capabilities advertisement.

Impact

Successful exploitation results in a firmware crash on the station, effectively disabling Wi-Fi connectivity and requiring a driver/firmware reload or system reboot to recover. This constitutes a denial-of-service (DoS) condition. The vulnerability is limited to ath11k-based devices (e.g., WCN6855, QCN9274) and does not allow arbitrary code execution or information disclosure based on the referenced patches.

Mitigation

The fix has been applied to the Linux kernel stable branches as commits [1][2]. Users should update to a kernel version containing the patch. No workaround is documented; affected devices must either avoid connecting to APs with the malformed MCS map or apply the kernel patch.