{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38505", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.022Z", "datePublished": "2025-08-16T10:54:42.909Z", "dateUpdated": "2026-08-05T12:02:30.556Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:30.556Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: discard erroneous disassoc frames on STA interface\n\nWhen operating in concurrent STA/AP mode with host MLME enabled,\nthe firmware incorrectly sends disassociation frames to the STA\ninterface when clients disconnect from the AP interface.\nThis causes kernel warnings as the STA interface processes\ndisconnect events that don't apply to it:\n\n[ 1303.240540] WARNING: CPU: 0 PID: 513 at net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.250861] Modules linked in: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us\n[ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 Not tainted 6.16.0-rc1+ #3 PREEMPT\n[ 1303.335937] Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT)\n[ 1303.343588] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex]\n[ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211]\n[ 1303.370221] sp : ffff800083053be0\n[ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 0000000000000000\n[ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae\n[ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008\n[ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006\n[ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048\n[ 1303.409910] x14: ffff000003625300 x13: 0000000000000001 x12: 0000000000000000\n[ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300\n[ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002\n[ 1303.431695] x5 : ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186\n[ 1303.438956] x2 : 000000004836ba20 x1 : 0000000000006986 x0 : 00000000d00479de\n[ 1303.446221] Call trace:\n[ 1303.448722] cfg80211_process_disassoc+0x78/0xec [cfg80211] (P)\n[ 1303.454894] cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211]\n[ 1303.460362] mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex]\n[ 1303.466380] mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex]\n[ 1303.472573] mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex]\n[ 1303.478243] mwifiex_rx_work_queue+0x158/0x198 [mwifiex]\n[ 1303.483734] process_one_work+0x14c/0x28c\n[ 1303.487845] worker_thread+0x2cc/0x3d4\n[ 1303.491680] kthread+0x12c/0x208\n[ 1303.495014] ret_from_fork+0x10/0x20\n\nAdd validation in the STA receive path to verify that disassoc/deauth\nframes originate from the connected AP. Frames that fail this check\nare discarded early, preventing them from reaching the MLME layer and\ntriggering WARN_ON().\n\nThis filtering logic is similar with that used in the\nieee80211_rx_mgmt_disassoc() function in mac80211, which drops\ndisassoc frames that don't match the current BSSID\n(!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), ensuring\nonly relevant frames are processed.\n\nTested on:\n- 8997 with FW 16.68.1.p197" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The trigger is a raw 802.11 deauth/disassoc management frame received over the air by the mwifiex STA interface, requiring the attacker to be within WiFi radio range of the target. Per kernel guidance, WiFi frame injection is Adjacent.\nAC:L - The attacker simply injects an unprotected disassoc frame addressed to the connected STA with a BSSID that differs from the associated AP; no race, memory-layout, or attacker-uncontrollable condition is involved. The only precondition is the STA being associated, which is its normal steady state and observable from the air.\nPR:N - No credentials or privileges on the target are needed — deauth/disassoc are unprotected management frames processed before any authentication or authorization check on this path. Even the firmware-driven variant is triggered by an ordinary client of the device's own AP interface, which confers no privilege on the host.\nUI:N - The frame is processed automatically in the MWIFIEX_RX_WORK_QUEUE worker on receipt; no action by any local user or administrator is required.\nS:U - The WARN and the driver state corruption are confined to the kernel of the affected host, with no crossing into a different security authority such as a hypervisor or IOMMU domain.\nC:N - The WARN path returns immediately without processing the frame; no memory is over-read and no data is returned to the attacker. The register/stack dump lands only in dmesg, which the adjacent unauthenticated attacker cannot read.\nI:L - A spoofed deauth from an arbitrary BSSID resets the driver's host-MLME state (`priv->auth_flag = 0`, `priv->auth_alg = WLAN_AUTH_NONE`) while connected, and `nl80211_send_deauth/disassoc` is emitted to userspace before the BSSID check, injecting bogus MLME events into wpa_supplicant. This is unauthorized but bounded modification of connection/authentication state, not arbitrary write.\nA:H - The bug reaches `WARN_ON()` in `cfg80211_process_disassoc()`, an oops-class event that becomes an immediate kernel panic on the many hardened, Android, and production configurations that set `panic_on_warn`. It can be re-triggered at will by repeated frame injection, giving sustained denial of service plus log flooding and kernel taint even without `panic_on_warn`." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/marvell/mwifiex/util.c" ], "versions": [ { "version": "36995892c271cce5e2230bc165a06f109b117222", "lessThan": "a963819a121f5dd61e0b39934d8b5dec529da96a", "status": "affected", "versionType": "git" }, { "version": "36995892c271cce5e2230bc165a06f109b117222", "lessThan": "52654cebaac23dae31a9c97ae0da5be649f1ab4d", "status": "affected", "versionType": "git" }, { "version": "36995892c271cce5e2230bc165a06f109b117222", "lessThan": "3b602ddc0df723992721b0d286c90c9bdd755b34", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/marvell/mwifiex/util.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.39", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.7", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.15.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a963819a121f5dd61e0b39934d8b5dec529da96a" }, { "url": "https://git.kernel.org/stable/c/52654cebaac23dae31a9c97ae0da5be649f1ab4d" }, { "url": "https://git.kernel.org/stable/c/3b602ddc0df723992721b0d286c90c9bdd755b34" } ], "title": "wifi: mwifiex: discard erroneous disassoc frames on STA interface", "x_generator": { "engine": "bippy-1.2.0" } } } }