CVE-2025-38505

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38505", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.022Z", "datePublished": "2025-08-16T10:54:42.909Z", "dateUpdated": "2026-10-15T21:52:17.826Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:30.556Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: discard erroneous disassoc frames on STA interface\n\nWhen operating in concurrent STA/AP mode with host MLME enabled,\nthe firmware incorrectly sends disassociation frames to the STA\ninterface when clients disconnect from the AP interface.\nThis causes kernel warnings as the STA interface processes\ndisconnect events that don't apply to it:\n\n[ 1303.240540] WARNING: CPU: 0 PID: 513 at net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.250861] Modules linked in: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us\n[ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 Not tainted 6.16.0-rc1+ #3 PREEMPT\n[ 1303.335937] Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT)\n[ 1303.343588] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex]\n[ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211]\n[ 1303.370221] sp : ffff800083053be0\n[ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 0000000000000000\n[ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae\n[ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008\n[ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006\n[ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048\n[ 1303.409910] x14: ffff000003625300 x13: 0000000000000001 x12: 0000000000000000\n[ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300\n[ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002\n[ 1303.431695] x5 : ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186\n[ 1303.438956] x2 : 000000004836ba20 x1 : 0000000000006986 x0 : 00000000d00479de\n[ 1303.446221] Call trace:\n[ 1303.448722] cfg80211_process_disassoc+0x78/0xec [cfg80211] (P)\n[ 1303.454894] cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211]\n[ 1303.460362] mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex]\n[ 1303.466380] mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex]\n[ 1303.472573] mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex]\n[ 1303.478243] mwifiex_rx_work_queue+0x158/0x198 [mwifiex]\n[ 1303.483734] process_one_work+0x14c/0x28c\n[ 1303.487845] worker_thread+0x2cc/0x3d4\n[ 1303.491680] kthread+0x12c/0x208\n[ 1303.495014] ret_from_fork+0x10/0x20\n\nAdd validation in the STA receive path to verify that disassoc/deauth\nframes originate from the connected AP. Frames that fail this check\nare discarded early, preventing them from reaching the MLME layer and\ntriggering WARN_ON().\n\nThis filtering logic is similar with that used in the\nieee80211_rx_mgmt_disassoc() function in mac80211, which drops\ndisassoc frames that don't match the current BSSID\n(!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), ensuring\nonly relevant frames are processed.\n\nTested on:\n- 8997 with FW 16.68.1.p197"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The trigger is a raw 802.11 deauth/disassoc management frame received over the air by the mwifiex STA interface, requiring the attacker to be within WiFi radio range of the target. Per kernel guidance, WiFi frame injection is Adjacent.\nAC:L - The attacker simply injects an unprotected disassoc frame addressed to the connected STA with a BSSID that differs from the associated AP; no race, memory-layout, or attacker-uncontrollable condition is involved. The only precondition is the STA being associated, which is its normal steady state and observable from the air.\nPR:N - No credentials or privileges on the target are needed \u2014 deauth/disassoc are unprotected management frames processed before any authentication or authorization check on this path. Even the firmware-driven variant is triggered by an ordinary client of the device's own AP interface, which confers no privilege on the host.\nUI:N - The frame is processed automatically in the MWIFIEX_RX_WORK_QUEUE worker on receipt; no action by any local user or administrator is required.\nS:U - The WARN and the driver state corruption are confined to the kernel of the affected host, with no crossing into a different security authority such as a hypervisor or IOMMU domain.\nC:N - The WARN path returns immediately without processing the frame; no memory is over-read and no data is returned to the attacker. The register/stack dump lands only in dmesg, which the adjacent unauthenticated attacker cannot read.\nI:L - A spoofed deauth from an arbitrary BSSID resets the driver's host-MLME state (`priv->auth_flag = 0`, `priv->auth_alg = WLAN_AUTH_NONE`) while connected, and `nl80211_send_deauth/disassoc` is emitted to userspace before the BSSID check, injecting bogus MLME events into wpa_supplicant. This is unauthorized but bounded modification of connection/authentication state, not arbitrary write.\nA:H - The bug reaches `WARN_ON()` in `cfg80211_process_disassoc()`, an oops-class event that becomes an immediate kernel panic on the many hardened, Android, and production configurations that set `panic_on_warn`. It can be re-triggered at will by repeated frame injection, giving sustained denial of service plus log flooding and kernel taint even without `panic_on_warn`."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/marvell/mwifiex/util.c"], "versions": [{"version": "36995892c271cce5e2230bc165a06f109b117222", "lessThan": "a963819a121f5dd61e0b39934d8b5dec529da96a", "status": "affected", "versionType": "git"}, {"version": "36995892c271cce5e2230bc165a06f109b117222", "lessThan": "52654cebaac23dae31a9c97ae0da5be649f1ab4d", "status": "affected", "versionType": "git"}, {"version": "36995892c271cce5e2230bc165a06f109b117222", "lessThan": "3b602ddc0df723992721b0d286c90c9bdd755b34", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/marvell/mwifiex/util.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.39", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.7", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.15.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a963819a121f5dd61e0b39934d8b5dec529da96a"}, {"url": "https://git.kernel.org/stable/c/52654cebaac23dae31a9c97ae0da5be649f1ab4d"}, {"url": "https://git.kernel.org/stable/c/3b602ddc0df723992721b0d286c90c9bdd755b34"}], "title": "wifi: mwifiex: discard erroneous disassoc frames on STA interface", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38505", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:51:06.493337Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:17.826Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38505", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:51:06.493337Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:07.089Z"}}], "cna": {"title": "wifi: mwifiex: discard erroneous disassoc frames on STA interface", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The trigger is a raw 802.11 deauth/disassoc management frame received over the air by the mwifiex STA interface, requiring the attacker to be within WiFi radio range of the target. Per kernel guidance, WiFi frame injection is Adjacent.\nAC:L - The attacker simply injects an unprotected disassoc frame addressed to the connected STA with a BSSID that differs from the associated AP; no race, memory-layout, or attacker-uncontrollable condition is involved. The only precondition is the STA being associated, which is its normal steady state and observable from the air.\nPR:N - No credentials or privileges on the target are needed \u2014 deauth/disassoc are unprotected management frames processed before any authentication or authorization check on this path. Even the firmware-driven variant is triggered by an ordinary client of the device's own AP interface, which confers no privilege on the host.\nUI:N - The frame is processed automatically in the MWIFIEX_RX_WORK_QUEUE worker on receipt; no action by any local user or administrator is required.\nS:U - The WARN and the driver state corruption are confined to the kernel of the affected host, with no crossing into a different security authority such as a hypervisor or IOMMU domain.\nC:N - The WARN path returns immediately without processing the frame; no memory is over-read and no data is returned to the attacker. The register/stack dump lands only in dmesg, which the adjacent unauthenticated attacker cannot read.\nI:L - A spoofed deauth from an arbitrary BSSID resets the driver's host-MLME state (`priv->auth_flag = 0`, `priv->auth_alg = WLAN_AUTH_NONE`) while connected, and `nl80211_send_deauth/disassoc` is emitted to userspace before the BSSID check, injecting bogus MLME events into wpa_supplicant. This is unauthorized but bounded modification of connection/authentication state, not arbitrary write.\nA:H - The bug reaches `WARN_ON()` in `cfg80211_process_disassoc()`, an oops-class event that becomes an immediate kernel panic on the many hardened, Android, and production configurations that set `panic_on_warn`. It can be re-triggered at will by repeated frame injection, giving sustained denial of service plus log flooding and kernel taint even without `panic_on_warn`."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "36995892c271cce5e2230bc165a06f109b117222", "lessThan": "a963819a121f5dd61e0b39934d8b5dec529da96a", "versionType": "git"}, {"status": "affected", "version": "36995892c271cce5e2230bc165a06f109b117222", "lessThan": "52654cebaac23dae31a9c97ae0da5be649f1ab4d", "versionType": "git"}, {"status": "affected", "version": "36995892c271cce5e2230bc165a06f109b117222", "lessThan": "3b602ddc0df723992721b0d286c90c9bdd755b34", "versionType": "git"}], "programFiles": ["drivers/net/wireless/marvell/mwifiex/util.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.39", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.7", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/marvell/mwifiex/util.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a963819a121f5dd61e0b39934d8b5dec529da96a"}, {"url": "https://git.kernel.org/stable/c/52654cebaac23dae31a9c97ae0da5be649f1ab4d"}, {"url": "https://git.kernel.org/stable/c/3b602ddc0df723992721b0d286c90c9bdd755b34"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: discard erroneous disassoc frames on STA interface\n\nWhen operating in concurrent STA/AP mode with host MLME enabled,\nthe firmware incorrectly sends disassociation frames to the STA\ninterface when clients disconnect from the AP interface.\nThis causes kernel warnings as the STA interface processes\ndisconnect events that don't apply to it:\n\n[ 1303.240540] WARNING: CPU: 0 PID: 513 at net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.250861] Modules linked in: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us\n[ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 Not tainted 6.16.0-rc1+ #3 PREEMPT\n[ 1303.335937] Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT)\n[ 1303.343588] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex]\n[ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211]\n[ 1303.370221] sp : ffff800083053be0\n[ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 0000000000000000\n[ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae\n[ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008\n[ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006\n[ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048\n[ 1303.409910] x14: ffff000003625300 x13: 0000000000000001 x12: 0000000000000000\n[ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300\n[ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002\n[ 1303.431695] x5 : ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186\n[ 1303.438956] x2 : 000000004836ba20 x1 : 0000000000006986 x0 : 00000000d00479de\n[ 1303.446221] Call trace:\n[ 1303.448722] cfg80211_process_disassoc+0x78/0xec [cfg80211] (P)\n[ 1303.454894] cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211]\n[ 1303.460362] mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex]\n[ 1303.466380] mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex]\n[ 1303.472573] mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex]\n[ 1303.478243] mwifiex_rx_work_queue+0x158/0x198 [mwifiex]\n[ 1303.483734] process_one_work+0x14c/0x28c\n[ 1303.487845] worker_thread+0x2cc/0x3d4\n[ 1303.491680] kthread+0x12c/0x208\n[ 1303.495014] ret_from_fork+0x10/0x20\n\nAdd validation in the STA receive path to verify that disassoc/deauth\nframes originate from the connected AP. Frames that fail this check\nare discarded early, preventing them from reaching the MLME layer and\ntriggering WARN_ON().\n\nThis filtering logic is similar with that used in the\nieee80211_rx_mgmt_disassoc() function in mac80211, which drops\ndisassoc frames that don't match the current BSSID\n(!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), ensuring\nonly relevant frames are processed.\n\nTested on:\n- 8997 with FW 16.68.1.p197"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.39", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.7", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:30.556Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38505", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:17.826Z", "dateReserved": "2025-04-16T04:51:24.022Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-08-16T10:54:42.909Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/marvell/mwifiex/util.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a963819a121f5dd61e0b39934d8b5dec529da96a", "status": "affected", "version": "36995892c271cce5e2230bc165a06f109b117222", "versionType": "git"}, {"lessThan": "52654cebaac23dae31a9c97ae0da5be649f1ab4d", "status": "affected", "version": "36995892c271cce5e2230bc165a06f109b117222", "versionType": "git"}, {"lessThan": "3b602ddc0df723992721b0d286c90c9bdd755b34", "status": "affected", "version": "36995892c271cce5e2230bc165a06f109b117222", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/marvell/mwifiex/util.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.39", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "527896FF-1AAC-4EE0-A79C-A35602C28862", "versionEndExcluding": "6.12.39", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1", "versionEndExcluding": "6.15.7", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*", "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: discard erroneous disassoc frames on STA interface\n\nWhen operating in concurrent STA/AP mode with host MLME enabled,\nthe firmware incorrectly sends disassociation frames to the STA\ninterface when clients disconnect from the AP interface.\nThis causes kernel warnings as the STA interface processes\ndisconnect events that don't apply to it:\n\n[ 1303.240540] WARNING: CPU: 0 PID: 513 at net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.250861] Modules linked in: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us\n[ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 Not tainted 6.16.0-rc1+ #3 PREEMPT\n[ 1303.335937] Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT)\n[ 1303.343588] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex]\n[ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211]\n[ 1303.370221] sp : ffff800083053be0\n[ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 0000000000000000\n[ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae\n[ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008\n[ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006\n[ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048\n[ 1303.409910] x14: ffff000003625300 x13: 0000000000000001 x12: 0000000000000000\n[ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300\n[ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002\n[ 1303.431695] x5 : ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186\n[ 1303.438956] x2 : 000000004836ba20 x1 : 0000000000006986 x0 : 00000000d00479de\n[ 1303.446221] Call trace:\n[ 1303.448722] cfg80211_process_disassoc+0x78/0xec [cfg80211] (P)\n[ 1303.454894] cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211]\n[ 1303.460362] mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex]\n[ 1303.466380] mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex]\n[ 1303.472573] mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex]\n[ 1303.478243] mwifiex_rx_work_queue+0x158/0x198 [mwifiex]\n[ 1303.483734] process_one_work+0x14c/0x28c\n[ 1303.487845] worker_thread+0x2cc/0x3d4\n[ 1303.491680] kthread+0x12c/0x208\n[ 1303.495014] ret_from_fork+0x10/0x20\n\nAdd validation in the STA receive path to verify that disassoc/deauth\nframes originate from the connected AP. Frames that fail this check\nare discarded early, preventing them from reaching the MLME layer and\ntriggering WARN_ON().\n\nThis filtering logic is similar with that used in the\nieee80211_rx_mgmt_disassoc() function in mac80211, which drops\ndisassoc frames that don't match the current BSSID\n(!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), ensuring\nonly relevant frames are processed.\n\nTested on:\n- 8997 with FW 16.68.1.p197"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mwifiex: descarta marcos de disociaci\u00f3n err\u00f3neos en la interfaz STA. Cuando se opera en modo STA/AP concurrente con MLME de host habilitado, el firmware env\u00eda incorrectamente marcos de disociaci\u00f3n a la interfaz STA cuando los clientes se desconectan de la interfaz AP. Esto genera advertencias del kernel ya que la interfaz STA procesa eventos de desconexi\u00f3n que no se aplican a ella: [ 1303.240540] ADVERTENCIA: CPU: 0 PID: 513 en net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211] [ 1303.250861] M\u00f3dulos vinculados: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us [ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 No contaminado 6.16.0-rc1+ #3 PREEMPT [ 1303.335937] Nombre del hardware: Toradex Verdin AM62 WB en placa de desarrollo Verdin (DT) [ 1303.343588] Cola de trabajo: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex] [ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211] [ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211] [ 1303.370221] sp : ffff800083053be0 [ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 00000000000000000 [ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae [ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008 [ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006 [ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048 [ 1303.409910] x14: ffff000003625300 x13: 000000000000001 x12: 0000000000000000 [ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300 [ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002 [ 1303.431695] x5 : ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186 [ 1303.438956] x2 : 000000004836ba20 x1 : 0000000000006986 x0 : 00000000d00479de [ 1303.446221] Rastreo de llamadas: [ 1303.448722] cfg80211_process_disassoc+0x78/0xec [cfg80211] (P) [ 1303.454894] cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211] [ 1303.460362] mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex] [ 1303.466380] mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex] [ 1303.472573] mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex] [ 1303.478243] mwifiex_rx_work_queue+0x158/0x198 [mwifiex] [ 1303.483734] process_one_work+0x14c/0x28c [ 1303.487845]worker_thread+0x2cc/0x3d4 [ 1303.491680] kthread+0x12c/0x208 [ 1303.495014] ret_from_fork+0x10/0x20 Agregue validaci\u00f3n en la ruta de recepci\u00f3n de STA para verificar que los marcos de desasociaci\u00f3n/desautorizaci\u00f3n se originen en el AP conectado. Las tramas que no superan esta comprobaci\u00f3n se descartan prematuramente, lo que impide que lleguen a la capa MLME y activen WARN_ON(). Esta l\u00f3gica de filtrado es similar a la utilizada en la funci\u00f3n ieee80211_rx_mgmt_disassoc() de mac80211, que descarta las tramas de desasociaci\u00f3n que no coinciden con el BSSID actual (!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), garantizando as\u00ed que solo se procesen las tramas relevantes. Probado en: - 8997 con firmware 16.68.1.p197"}], "id": "CVE-2025-38505", "lastModified": "2026-10-15T22:18:43.550", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38505", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:51:06.493337Z", "version": "2.0.3"}}]}, "published": "2025-08-16T11:15:43.407", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b602ddc0df723992721b0d286c90c9bdd755b34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/52654cebaac23dae31a9c97ae0da5be649f1ab4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a963819a121f5dd61e0b39934d8b5dec529da96a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: mwifiex: discard erroneous disassoc frames on STA interface", "id": "2391057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391057"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mwifiex: discard erroneous disassoc frames on STA interface\nWhen operating in concurrent STA/AP mode with host MLME enabled,\nthe firmware incorrectly sends disassociation frames to the STA\ninterface when clients disconnect from the AP interface.\nThis causes kernel warnings as the STA interface processes\ndisconnect events that don't apply to it:\n[ 1303.240540] WARNING: CPU: 0 PID: 513 at net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.250861] Modules linked in: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us\n[ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 Not tainted 6.16.0-rc1+ #3 PREEMPT\n[ 1303.335937] Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT)\n[ 1303.343588] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex]\n[ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211]\n[ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211]\n[ 1303.370221] sp : ffff800083053be0\n[ 1303.373590] x29: ffff800083053be0 x28: 0000000000000000 x27: 0000000000000000\n[ 1303.380855] x26: 0000000000000000 x25: 00000000ffffffff x24: ffff000002c5b8ae\n[ 1303.388120] x23: ffff000002c5b884 x22: 0000000000000001 x21: 0000000000000008\n[ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: 0000000000000006\n[ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048\n[ 1303.409910] x14: ffff000003625300 x13: 0000000000000001 x12: 0000000000000000\n[ 1303.417173] x11: 0000000000000002 x10: ffff000003958600 x9 : ffff000003625300\n[ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : 0000000000000002\n[ 1303.431695] x5 : ffff0000038976d4 x4 : 0000000000000000 x3 : 0000000000003186\n[ 1303.438956] x2 : 000000004836ba20 x1 : 0000000000006986 x0 : 00000000d00479de\n[ 1303.446221] Call trace:\n[ 1303.448722] cfg80211_process_disassoc+0x78/0xec [cfg80211] (P)\n[ 1303.454894] cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211]\n[ 1303.460362] mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex]\n[ 1303.466380] mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex]\n[ 1303.472573] mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex]\n[ 1303.478243] mwifiex_rx_work_queue+0x158/0x198 [mwifiex]\n[ 1303.483734] process_one_work+0x14c/0x28c\n[ 1303.487845] worker_thread+0x2cc/0x3d4\n[ 1303.491680] kthread+0x12c/0x208\n[ 1303.495014] ret_from_fork+0x10/0x20\nAdd validation in the STA receive path to verify that disassoc/deauth\nframes originate from the connected AP. Frames that fail this check\nare discarded early, preventing them from reaching the MLME layer and\ntriggering WARN_ON().\nThis filtering logic is similar with that used in the\nieee80211_rx_mgmt_disassoc() function in mac80211, which drops\ndisassoc frames that don't match the current BSSID\n(!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), ensuring\nonly relevant frames are processed.\nTested on:\n- 8997 with FW 16.68.1.p197"], "name": "CVE-2025-38505", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-08-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38505\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38505\nhttps://lore.kernel.org/linux-cve-announce/2025081649-CVE-2025-38505-1bf6@gregkh/T"], "statement": "The vulnerability in mwifiex could cause spurious disassociation events on the STA interface when operating concurrently in STA/AP mode. Erroneous frames sent by the firmware were processed without validating the source, leading to kernel warnings and potential disruption of connectivity.", "threat_severity": "Low"}

{"created": "2025-08-21T12:59:15.085283+00:00", "updated": "2025-08-21T12:59:15.085343+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}