Listen to this Post
How the CVE Works
This vulnerability exists in the Linux kernel’s `mac80211` WiFi subsystem. When a VHT (Very High Throughput) operating mode notification is processed, the `sta_link_apply_parameters()` function fails to validate the specified channel width. An attacker can send a malicious VHT notification containing an invalid channel width, such as 5 MHz or 10 MHz, which are not defined in the VHT specification. This malformed data is passed to ieee80211_chan_width_to_rx_bw(), triggering a kernel WARN_ON due to the unexpected input. This results in a kernel warning and a potential local denial-of-service (DoS) condition, destabilizing the system.
Platform: Linux Kernel
Version: mac80211 subsystem
Vulnerability: DoS
Severity: Medium
date: 2025-08-16
Prediction: 2025-09-30
What Undercode Say:
Check kernel logs for warnings dmesg | grep -i "WARN" Monitor for specific syzbot reports related to mac80211
// Code snippet from the vulnerable function
static int sta_link_apply_parameters(struct ieee80211_sub_if_data sdata,
struct link_sta_info link_sta,
struct link_parameters params) {
// ... Missing validation for opmode_notif->width ...
bw = ieee80211_chan_width_to_rx_bw(opmode_notif->width); // WARN_ON triggered here
}
How Exploit:
A local attacker can trigger this vulnerability by sending a forged VHT operating mode notification frame with an invalid channel width (e.g., 5 or 10 MHz) to a vulnerable system, causing a kernel warning and potential system instability.
Protection from this CVE
Apply the official kernel patch that adds early validation in `sta_link_apply_parameters()` to reject unsupported VHT channel widths (specifically 5 and 10 MHz).
Impact:
Local Denial-of-Service (DoS) through a kernel warning, leading to potential system instability and log contamination.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
