{"cve":"CVE-2025-40131","nvd":{"published":"2025-11-12T11:15:42.753","modified":"2026-10-19T21:10:00.160","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()\n\nIn ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because\nrxcb->peer_id is not updated with a valid value. This is expected\nin monitor mode, where RX frames bypass the regular RX\ndescriptor path that typically sets rxcb->peer_id.\nAs a result, the peer is NULL, and link_id and link_valid fields\nin the RX status are not populated. This leads to a WARN_ON in\nmac80211 when it receives data frame from an associated station\nwith invalid link_id.\n\nFix this potential issue by using ppduinfo->peer_id, which holds\nthe correct peer id for the received frame. This ensures that the\npeer is correctly found and the associated link metadata is updated\naccordingly.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566","https://git.kernel.org/stable/c/da64eb2da76ce5626238a951fdf3e81810454427"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2025-40131","score":0.0021,"percentile":0.11146,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}