Vulnerability-Lookup

GHSA-F23X-VP93-47JP

Vulnerability from github – Published: 2025-03-06 18:31 – Updated: 2025-10-31 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: don't flush non-uploaded STAs

If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never knew about the station, so trying to flush it is unexpected and may crash.

Check if the sta was uploaded to the driver before and fix this.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-21828"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-06T16:15:55Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t flush non-uploaded STAs\n\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\nscenarios) and insertion fails, the station is freed.\nIn this case, the driver never knew about the station,\nso trying to flush it is unexpected and may crash.\n\nCheck if the sta was uploaded to the driver before and\nfix this.",
  "id": "GHSA-f23x-vp93-47jp",
  "modified": "2025-10-31T18:31:10Z",
  "published": "2025-03-06T18:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21828"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9efb5531271fa7ebae993b2a33a705d9947c7ce6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cd10b7fcb95a6a86c67adc54304c59a578ab16af"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cf21ef3d430847ba864bbc9b2774fffcc03ce321"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-21828 (GCVE-0-2025-21828)

Vulnerability from cvelistv5 – Published: 2025-03-06 16:04 – Updated: 2026-08-05 11:54

Title

wifi: mac80211: don't flush non-uploaded STAs

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never knew about the station, so trying to flush it is unexpected and may crash. Check if the sta was uploaded to the driver before and fix this.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6847 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/cf21ef3d430847ba8…
https://git.kernel.org/stable/c/cd10b7fcb95a6a86c…
https://git.kernel.org/stable/c/9efb5531271fa7eba…
https://git.kernel.org/stable/c/aa3ce3f8fafa0b8fb…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d00800a289c9349bb659a698cbd7bc04521dc927 , < cf21ef3d430847ba864bbc9b2774fffcc03ce321 (git) Affected: d00800a289c9349bb659a698cbd7bc04521dc927 , < cd10b7fcb95a6a86c67adc54304c59a578ab16af (git) Affected: d00800a289c9349bb659a698cbd7bc04521dc927 , < 9efb5531271fa7ebae993b2a33a705d9947c7ce6 (git) Affected: d00800a289c9349bb659a698cbd7bc04521dc927 , < aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450 (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.76 , ≤ 6.6.* (semver) Unaffected: 6.12.13 , ≤ 6.12.* (semver) Unaffected: 6.13.2 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/driver-ops.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf21ef3d430847ba864bbc9b2774fffcc03ce321",
              "status": "affected",
              "version": "d00800a289c9349bb659a698cbd7bc04521dc927",
              "versionType": "git"
            },
            {
              "lessThan": "cd10b7fcb95a6a86c67adc54304c59a578ab16af",
              "status": "affected",
              "version": "d00800a289c9349bb659a698cbd7bc04521dc927",
              "versionType": "git"
            },
            {
              "lessThan": "9efb5531271fa7ebae993b2a33a705d9947c7ce6",
              "status": "affected",
              "version": "d00800a289c9349bb659a698cbd7bc04521dc927",
              "versionType": "git"
            },
            {
              "lessThan": "aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450",
              "status": "affected",
              "version": "d00800a289c9349bb659a698cbd7bc04521dc927",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/driver-ops.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.76",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t flush non-uploaded STAs\n\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\nscenarios) and insertion fails, the station is freed.\nIn this case, the driver never knew about the station,\nso trying to flush it is unexpected and may crash.\n\nCheck if the sta was uploaded to the driver before and\nfix this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable state is created entirely by received 802.11 frames \u2014 rx.c:4471 calls ieee80211_ibss_rx_no_sta() for any frame carrying the (publicly beaconed) IBSS BSSID from an unknown source MAC, and mesh_sta_info_alloc() does the same for 802.11s peers. The attacker only needs to be within radio range of the victim\u0027s IBSS/mesh interface.\nAC:L - The attacker drives every side of the trigger: spamming duplicate spoofed source MACs floods ifibss-\u003eincomplete_stations so the second sta_info_insert_rcu() fails (-ENOTUNIQ via NEEDS_UNIQUE_STA_ADDR, or -EEXIST), and spraying \u003e16 distinct MACs exhausts the firmware station table so iwl_mvm_add_sta() fails into the ADHOC \"keeping it anyway\" path. Both are freely repeatable with no condition outside the attacker\u0027s control.\nPR:N - IBSS and open-mesh peer discovery process frames from completely unknown stations before any authentication, association, or key exchange \u2014 sta_info_alloc() is reached straight out of the RX path with no credential check. The attacker holds no account, session, or capability on the target.\nUI:N - No victim action is needed; the target merely has to have its ad-hoc/mesh interface up, and the attacker\u0027s injected frames alone drive allocation, insertion failure, and the bad driver callback.\nS:U - The corruption is confined to kernel mac80211/iwlwifi TX state within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The driver acts on station private state it never initialized, and in the IBSS path on a stale firmware sta_id (mvm_sta-\u003elink[0] is never cleared by iwl_mvm_rm_sta), so iwl_mvm_tx_reclaim() reads mvm-\u003efw_id_to_mac_id[] and reclaims another peer\u0027s in-flight TX descriptors \u2014 a stale-index/UAF-class read over reclaimed DMA buffers and cross-station TX status.\nI:H - iwl_trans_reclaim() runs on the wrong station\u0027s live queue at a firmware-supplied index before the tid_data-\u003etxq_id mismatch guard, freeing TFDs and skbs still owned by another station\u0027s in-flight transmit and advancing that queue\u0027s read pointer, so the real completion reclaims them again \u2014 a double-free/memory-corruption primitive reachable from injected frames.\nA:H - The fix commit states outright that flushing a station the driver never knew about \"may crash\"; concretely it produces WARN_ON/oops on uninitialized driver private state, wrong-queue reclaim, and TXPATH_FLUSH for an invalid sta_id that asserts the firmware and forces a full NIC restart with loss of connectivity."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:45.394Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf21ef3d430847ba864bbc9b2774fffcc03ce321"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd10b7fcb95a6a86c67adc54304c59a578ab16af"
        },
        {
          "url": "https://git.kernel.org/stable/c/9efb5531271fa7ebae993b2a33a705d9947c7ce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450"
        }
      ],
      "title": "wifi: mac80211: don\u0027t flush non-uploaded STAs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21828",
    "datePublished": "2025-03-06T16:04:33.641Z",
    "dateReserved": "2024-12-29T08:45:45.776Z",
    "dateUpdated": "2026-08-05T11:54:45.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted