{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21828", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.776Z", "datePublished": "2025-03-06T16:04:33.641Z", "dateUpdated": "2026-08-05T11:54:45.394Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:45.394Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't flush non-uploaded STAs\n\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\nscenarios) and insertion fails, the station is freed.\nIn this case, the driver never knew about the station,\nso trying to flush it is unexpected and may crash.\n\nCheck if the sta was uploaded to the driver before and\nfix this." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable state is created entirely by received 802.11 frames — rx.c:4471 calls ieee80211_ibss_rx_no_sta() for any frame carrying the (publicly beaconed) IBSS BSSID from an unknown source MAC, and mesh_sta_info_alloc() does the same for 802.11s peers. The attacker only needs to be within radio range of the victim's IBSS/mesh interface.\nAC:L - The attacker drives every side of the trigger: spamming duplicate spoofed source MACs floods ifibss->incomplete_stations so the second sta_info_insert_rcu() fails (-ENOTUNIQ via NEEDS_UNIQUE_STA_ADDR, or -EEXIST), and spraying >16 distinct MACs exhausts the firmware station table so iwl_mvm_add_sta() fails into the ADHOC \"keeping it anyway\" path. Both are freely repeatable with no condition outside the attacker's control.\nPR:N - IBSS and open-mesh peer discovery process frames from completely unknown stations before any authentication, association, or key exchange — sta_info_alloc() is reached straight out of the RX path with no credential check. The attacker holds no account, session, or capability on the target.\nUI:N - No victim action is needed; the target merely has to have its ad-hoc/mesh interface up, and the attacker's injected frames alone drive allocation, insertion failure, and the bad driver callback.\nS:U - The corruption is confined to kernel mac80211/iwlwifi TX state within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The driver acts on station private state it never initialized, and in the IBSS path on a stale firmware sta_id (mvm_sta->link[0] is never cleared by iwl_mvm_rm_sta), so iwl_mvm_tx_reclaim() reads mvm->fw_id_to_mac_id[] and reclaims another peer's in-flight TX descriptors — a stale-index/UAF-class read over reclaimed DMA buffers and cross-station TX status.\nI:H - iwl_trans_reclaim() runs on the wrong station's live queue at a firmware-supplied index before the tid_data->txq_id mismatch guard, freeing TFDs and skbs still owned by another station's in-flight transmit and advancing that queue's read pointer, so the real completion reclaims them again — a double-free/memory-corruption primitive reachable from injected frames.\nA:H - The fix commit states outright that flushing a station the driver never knew about \"may crash\"; concretely it produces WARN_ON/oops on uninitialized driver private state, wrong-queue reclaim, and TXPATH_FLUSH for an invalid sta_id that asserts the firmware and forces a full NIC restart with loss of connectivity." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/mac80211/driver-ops.h" ], "versions": [ { "version": "d00800a289c9349bb659a698cbd7bc04521dc927", "lessThan": "cf21ef3d430847ba864bbc9b2774fffcc03ce321", "status": "affected", "versionType": "git" }, { "version": "d00800a289c9349bb659a698cbd7bc04521dc927", "lessThan": "cd10b7fcb95a6a86c67adc54304c59a578ab16af", "status": "affected", "versionType": "git" }, { "version": "d00800a289c9349bb659a698cbd7bc04521dc927", "lessThan": "9efb5531271fa7ebae993b2a33a705d9947c7ce6", "status": "affected", "versionType": "git" }, { "version": "d00800a289c9349bb659a698cbd7bc04521dc927", "lessThan": "aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/mac80211/driver-ops.h" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cf21ef3d430847ba864bbc9b2774fffcc03ce321" }, { "url": "https://git.kernel.org/stable/c/cd10b7fcb95a6a86c67adc54304c59a578ab16af" }, { "url": "https://git.kernel.org/stable/c/9efb5531271fa7ebae993b2a33a705d9947c7ce6" }, { "url": "https://git.kernel.org/stable/c/aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450" } ], "title": "wifi: mac80211: don't flush non-uploaded STAs", "x_generator": { "engine": "bippy-1.2.0" } } } }