CVE-2025-21828 (GCVE-0-2025-21828)

Vulnerability from cvelistv5 – Published: 2025-03-06 16:04 – Updated: 2026-08-05 11:54
VLAI
Title
wifi: mac80211: don't flush non-uploaded STAs
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never knew about the station, so trying to flush it is unexpected and may crash. Check if the sta was uploaded to the driver before and fix this.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d00800a289c9349bb659a698cbd7bc04521dc927 , < cf21ef3d430847ba864bbc9b2774fffcc03ce321 (git)
Affected: d00800a289c9349bb659a698cbd7bc04521dc927 , < cd10b7fcb95a6a86c67adc54304c59a578ab16af (git)
Affected: d00800a289c9349bb659a698cbd7bc04521dc927 , < 9efb5531271fa7ebae993b2a33a705d9947c7ce6 (git)
Affected: d00800a289c9349bb659a698cbd7bc04521dc927 , < aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450 (git)
Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.76 , ≤ 6.6.* (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/driver-ops.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf21ef3d430847ba864bbc9b2774fffcc03ce321",
              "status": "affected",
              "version": "d00800a289c9349bb659a698cbd7bc04521dc927",
              "versionType": "git"
            },
            {
              "lessThan": "cd10b7fcb95a6a86c67adc54304c59a578ab16af",
              "status": "affected",
              "version": "d00800a289c9349bb659a698cbd7bc04521dc927",
              "versionType": "git"
            },
            {
              "lessThan": "9efb5531271fa7ebae993b2a33a705d9947c7ce6",
              "status": "affected",
              "version": "d00800a289c9349bb659a698cbd7bc04521dc927",
              "versionType": "git"
            },
            {
              "lessThan": "aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450",
              "status": "affected",
              "version": "d00800a289c9349bb659a698cbd7bc04521dc927",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/driver-ops.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.76",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t flush non-uploaded STAs\n\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\nscenarios) and insertion fails, the station is freed.\nIn this case, the driver never knew about the station,\nso trying to flush it is unexpected and may crash.\n\nCheck if the sta was uploaded to the driver before and\nfix this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable state is created entirely by received 802.11 frames \u2014 rx.c:4471 calls ieee80211_ibss_rx_no_sta() for any frame carrying the (publicly beaconed) IBSS BSSID from an unknown source MAC, and mesh_sta_info_alloc() does the same for 802.11s peers. The attacker only needs to be within radio range of the victim\u0027s IBSS/mesh interface.\nAC:L - The attacker drives every side of the trigger: spamming duplicate spoofed source MACs floods ifibss-\u003eincomplete_stations so the second sta_info_insert_rcu() fails (-ENOTUNIQ via NEEDS_UNIQUE_STA_ADDR, or -EEXIST), and spraying \u003e16 distinct MACs exhausts the firmware station table so iwl_mvm_add_sta() fails into the ADHOC \"keeping it anyway\" path. Both are freely repeatable with no condition outside the attacker\u0027s control.\nPR:N - IBSS and open-mesh peer discovery process frames from completely unknown stations before any authentication, association, or key exchange \u2014 sta_info_alloc() is reached straight out of the RX path with no credential check. The attacker holds no account, session, or capability on the target.\nUI:N - No victim action is needed; the target merely has to have its ad-hoc/mesh interface up, and the attacker\u0027s injected frames alone drive allocation, insertion failure, and the bad driver callback.\nS:U - The corruption is confined to kernel mac80211/iwlwifi TX state within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The driver acts on station private state it never initialized, and in the IBSS path on a stale firmware sta_id (mvm_sta-\u003elink[0] is never cleared by iwl_mvm_rm_sta), so iwl_mvm_tx_reclaim() reads mvm-\u003efw_id_to_mac_id[] and reclaims another peer\u0027s in-flight TX descriptors \u2014 a stale-index/UAF-class read over reclaimed DMA buffers and cross-station TX status.\nI:H - iwl_trans_reclaim() runs on the wrong station\u0027s live queue at a firmware-supplied index before the tid_data-\u003etxq_id mismatch guard, freeing TFDs and skbs still owned by another station\u0027s in-flight transmit and advancing that queue\u0027s read pointer, so the real completion reclaims them again \u2014 a double-free/memory-corruption primitive reachable from injected frames.\nA:H - The fix commit states outright that flushing a station the driver never knew about \"may crash\"; concretely it produces WARN_ON/oops on uninitialized driver private state, wrong-queue reclaim, and TXPATH_FLUSH for an invalid sta_id that asserts the firmware and forces a full NIC restart with loss of connectivity."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:45.394Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf21ef3d430847ba864bbc9b2774fffcc03ce321"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd10b7fcb95a6a86c67adc54304c59a578ab16af"
        },
        {
          "url": "https://git.kernel.org/stable/c/9efb5531271fa7ebae993b2a33a705d9947c7ce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450"
        }
      ],
      "title": "wifi: mac80211: don\u0027t flush non-uploaded STAs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21828",
    "datePublished": "2025-03-06T16:04:33.641Z",
    "dateReserved": "2024-12-29T08:45:45.776Z",
    "dateUpdated": "2026-08-05T11:54:45.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21828",
      "date": "2026-08-11",
      "epss": "0.0022",
      "percentile": "0.1262"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21828\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-06T16:15:55.070\",\"lastModified\":\"2026-07-30T06:21:39.767\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: don\u0027t flush non-uploaded STAs\\n\\nIf STA state is pre-moved to AUTHORIZED (such as in IBSS\\nscenarios) and insertion fails, the station is freed.\\nIn this case, the driver never knew about the station,\\nso trying to flush it is unexpected and may crash.\\n\\nCheck if the sta was uploaded to the driver before and\\nfix this.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: no vac\u00ede las STA no cargadas Si el estado de la STA se mueve previamente a AUTORIZADO (como en los escenarios de IBSS) y la inserci\u00f3n falla, la estaci\u00f3n se libera. En este caso, el controlador nunca supo de la estaci\u00f3n, por lo que intentar vaciarla es inesperado y puede bloquearse. Verifique si la estaci\u00f3n se carg\u00f3 al controlador antes y solucione este problema.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac80211/driver-ops.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d00800a289c9349bb659a698cbd7bc04521dc927\",\"lessThan\":\"cf21ef3d430847ba864bbc9b2774fffcc03ce321\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d00800a289c9349bb659a698cbd7bc04521dc927\",\"lessThan\":\"cd10b7fcb95a6a86c67adc54304c59a578ab16af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d00800a289c9349bb659a698cbd7bc04521dc927\",\"lessThan\":\"9efb5531271fa7ebae993b2a33a705d9947c7ce6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d00800a289c9349bb659a698cbd7bc04521dc927\",\"lessThan\":\"aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac80211/driver-ops.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.76\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.13\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.2\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.6.76\",\"matchCriteriaId\":\"C6A28F1A-2CCA-4B18-AA73-20D184A7D477\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.13\",\"matchCriteriaId\":\"2897389C-A8C3-4D69-90F2-E701B3D66373\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.2\",\"matchCriteriaId\":\"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9efb5531271fa7ebae993b2a33a705d9947c7ce6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa3ce3f8fafa0b8fb062f28024855ea8cb3f3450\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd10b7fcb95a6a86c67adc54304c59a578ab16af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cf21ef3d430847ba864bbc9b2774fffcc03ce321\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:39:05+00:00",
      "cve": "CVE-2025-21828",
      "id": "CVE-2025-21828",
      "initial_release_date": "2025-03-06T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: don\u0027t flush non-uploaded STAs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21828.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:19:31Z",
      "cve": "CVE-2025-21828",
      "id": "CVE-2025-21828",
      "initial_release_date": "2025-03-07T02:37:09Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "286",
      "product_status:recommended": "445",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21828",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21828.json",
      "version": "41"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.