CVE-2025-38450

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload()

Add a NULL check for msta->vif before accessing its members to prevent

a kernel panic in AP mode deployment. This also fix the issue reported

in [1].

The crash occurs when this function is triggered before the station is

fully initialized. The call trace shows a page fault at

mt7925_sta_set_decap_offload() due to accessing resources when msta->vif

is NULL.

Fix this by adding an early return if msta->vif is NULL and also check

wcid.sta is ready. This ensures we only proceed with decap offload

configuration when the station's state is properly initialized.

[14739.655703] Unable to handle kernel paging request at virtual address ffffffffffffffa0

[14739.811820] CPU: 0 UID: 0 PID: 895854 Comm: hostapd Tainted: G

[14739.821394] Tainted: [C]=CRAP, [O]=OOT_MODULE

[14739.825746] Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT)

[14739.8

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References