CVE-2025-21828

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21828", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.776Z", "datePublished": "2025-03-06T16:04:33.641Z", "dateUpdated": "2026-08-05T11:54:45.394Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:45.394Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't flush non-uploaded STAs\n\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\nscenarios) and insertion fails, the station is freed.\nIn this case, the driver never knew about the station,\nso trying to flush it is unexpected and may crash.\n\nCheck if the sta was uploaded to the driver before and\nfix this."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable state is created entirely by received 802.11 frames \u2014 rx.c:4471 calls ieee80211_ibss_rx_no_sta() for any frame carrying the (publicly beaconed) IBSS BSSID from an unknown source MAC, and mesh_sta_info_alloc() does the same for 802.11s peers. The attacker only needs to be within radio range of the victim's IBSS/mesh interface.\nAC:L - The attacker drives every side of the trigger: spamming duplicate spoofed source MACs floods ifibss->incomplete_stations so the second sta_info_insert_rcu() fails (-ENOTUNIQ via NEEDS_UNIQUE_STA_ADDR, or -EEXIST), and spraying >16 distinct MACs exhausts the firmware station table so iwl_mvm_add_sta() fails into the ADHOC \"keeping it anyway\" path. Both are freely repeatable with no condition outside the attacker's control.\nPR:N - IBSS and open-mesh peer discovery process frames from completely unknown stations before any authentication, association, or key exchange \u2014 sta_info_alloc() is reached straight out of the RX path with no credential check. The attacker holds no account, session, or capability on the target.\nUI:N - No victim action is needed; the target merely has to have its ad-hoc/mesh interface up, and the attacker's injected frames alone drive allocation, insertion failure, and the bad driver callback.\nS:U - The corruption is confined to kernel mac80211/iwlwifi TX state within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The driver acts on station private state it never initialized, and in the IBSS path on a stale firmware sta_id (mvm_sta->link[0] is never cleared by iwl_mvm_rm_sta), so iwl_mvm_tx_reclaim() reads mvm->fw_id_to_mac_id[] and reclaims another peer's in-flight TX descriptors \u2014 a stale-index/UAF-class read over reclaimed DMA buffers and cross-station TX status.\nI:H - iwl_trans_reclaim() runs on the wrong station's live queue at a firmware-supplied index before the tid_data->txq_id mismatch guard, freeing TFDs and skbs still owned by another station's in-flight transmit and advancing that queue's read pointer, so the real completion reclaims them again \u2014 a double-free/memory-corruption primitive reachable from injected frames.\nA:H - The fix commit states outright that flushing a station the driver never knew about \"may crash\"; concretely it produces WARN_ON/oops on uninitialized driver private state, wrong-queue reclaim, and TXPATH_FLUSH for an invalid sta_id that asserts the firmware and forces a full NIC restart with loss of connectivity."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/driver-ops.h"], "versions": [{"version": "d00800a289c9349bb659a698cbd7bc04521dc927", "lessThan": "cf21ef3d430847ba864bbc9b2774fffcc03ce321", "status": "affected", "versionType": "git"}, {"version": "d00800a289c9349bb659a698cbd7bc04521dc927", "lessThan": "cd10b7fcb95a6a86c67adc54304c59a578ab16af", "status": "affected", "versionType": "git"}, {"version": "d00800a289c9349bb659a698cbd7bc04521dc927", "lessThan": "9efb5531271fa7ebae993b2a33a705d9947c7ce6", "status": "affected", "versionType": "git"}, {"version": "d00800a289c9349bb659a698cbd7bc04521dc927", "lessThan": "aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/driver-ops.h"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.76"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.13.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cf21ef3d430847ba864bbc9b2774fffcc03ce321"}, {"url": "https://git.kernel.org/stable/c/cd10b7fcb95a6a86c67adc54304c59a578ab16af"}, {"url": "https://git.kernel.org/stable/c/9efb5531271fa7ebae993b2a33a705d9947c7ce6"}, {"url": "https://git.kernel.org/stable/c/aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450"}], "title": "wifi: mac80211: don't flush non-uploaded STAs", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/driver-ops.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cf21ef3d430847ba864bbc9b2774fffcc03ce321", "status": "affected", "version": "d00800a289c9349bb659a698cbd7bc04521dc927", "versionType": "git"}, {"lessThan": "cd10b7fcb95a6a86c67adc54304c59a578ab16af", "status": "affected", "version": "d00800a289c9349bb659a698cbd7bc04521dc927", "versionType": "git"}, {"lessThan": "9efb5531271fa7ebae993b2a33a705d9947c7ce6", "status": "affected", "version": "d00800a289c9349bb659a698cbd7bc04521dc927", "versionType": "git"}, {"lessThan": "aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450", "status": "affected", "version": "d00800a289c9349bb659a698cbd7bc04521dc927", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/driver-ops.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.76", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.13", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6A28F1A-2CCA-4B18-AA73-20D184A7D477", "versionEndExcluding": "6.6.76", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2897389C-A8C3-4D69-90F2-E701B3D66373", "versionEndExcluding": "6.12.13", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D4116B1-1BFD-4F23-BA84-169CC05FC5A3", "versionEndExcluding": "6.13.2", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't flush non-uploaded STAs\n\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\nscenarios) and insertion fails, the station is freed.\nIn this case, the driver never knew about the station,\nso trying to flush it is unexpected and may crash.\n\nCheck if the sta was uploaded to the driver before and\nfix this."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: no vac\u00ede las STA no cargadas Si el estado de la STA se mueve previamente a AUTORIZADO (como en los escenarios de IBSS) y la inserci\u00f3n falla, la estaci\u00f3n se libera. En este caso, el controlador nunca supo de la estaci\u00f3n, por lo que intentar vaciarla es inesperado y puede bloquearse. Verifique si la estaci\u00f3n se carg\u00f3 al controlador antes y solucione este problema."}], "id": "CVE-2025-21828", "lastModified": "2026-07-30T06:21:39.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-03-06T16:15:55.070", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9efb5531271fa7ebae993b2a33a705d9947c7ce6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd10b7fcb95a6a86c67adc54304c59a578ab16af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cf21ef3d430847ba864bbc9b2774fffcc03ce321"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: mac80211: don't flush non-uploaded STAs", "id": "2350386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2350386"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: don't flush non-uploaded STAs\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\nscenarios) and insertion fails, the station is freed.\nIn this case, the driver never knew about the station,\nso trying to flush it is unexpected and may crash.\nCheck if the sta was uploaded to the driver before and\nfix this."], "name": "CVE-2025-21828", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21828\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21828\nhttps://lore.kernel.org/linux-cve-announce/2025030630-CVE-2025-21828-cb05@gregkh/T"], "threat_severity": "Moderate"}

{}