GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2025-38509

Vulnerability from fkie_nvd - Published: 2025-08-16 11:15 - Updated: 2026-06-17 09:17
Severity
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject VHT opmode for unsupported channel widths VHT operating mode notifications are not defined for channel widths below 20 MHz. In particular, 5 MHz and 10 MHz are not valid under the VHT specification and must be rejected. Without this check, malformed notifications using these widths may reach ieee80211_chan_width_to_rx_bw(), leading to a WARN_ON due to invalid input. This issue was reported by syzbot. Reject these unsupported widths early in sta_link_apply_parameters() when opmode_notif is used. The accepted set includes 20, 40, 80, 160, and 80+80 MHz, which are valid for VHT. While 320 MHz is not defined for VHT, it is allowed to avoid rejecting HE or EHT clients that may still send a VHT opmode notification.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/18eca59a04500b68a90e0c5c873f97c9d1ea2bfaPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/58fcb1b4287ce38850402bb2bb16d09bf77b91d9Patch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.16
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/cfg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "18eca59a04500b68a90e0c5c873f97c9d1ea2bfa",
              "status": "affected",
              "version": "751e7489c1d74b94ffffbed619d8fd724eeff4ee",
              "versionType": "git"
            },
            {
              "lessThan": "58fcb1b4287ce38850402bb2bb16d09bf77b91d9",
              "status": "affected",
              "version": "751e7489c1d74b94ffffbed619d8fd724eeff4ee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/cfg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1",
              "versionEndExcluding": "6.15.7",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reject VHT opmode for unsupported channel widths\n\nVHT operating mode notifications are not defined for channel widths\nbelow 20 MHz. In particular, 5 MHz and 10 MHz are not valid under the\nVHT specification and must be rejected.\n\nWithout this check, malformed notifications using these widths may\nreach ieee80211_chan_width_to_rx_bw(), leading to a WARN_ON due to\ninvalid input. This issue was reported by syzbot.\n\nReject these unsupported widths early in sta_link_apply_parameters()\nwhen opmode_notif is used. The accepted set includes 20, 40, 80, 160,\nand 80+80 MHz, which are valid for VHT. While 320 MHz is not defined\nfor VHT, it is allowed to avoid rejecting HE or EHT clients that may\nstill send a VHT opmode notification."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: rechazar el modo de operaci\u00f3n VHT para anchos de canal no compatibles. Las notificaciones del modo de operaci\u00f3n VHT no est\u00e1n definidas para anchos de canal inferiores a 20 MHz. En particular, 5 MHz y 10 MHz no son v\u00e1lidos seg\u00fan la especificaci\u00f3n VHT y deben rechazarse. Sin esta comprobaci\u00f3n, las notificaciones malformadas que utilicen estos anchos pueden alcanzar ieee80211_chan_width_to_rx_bw(), lo que genera un WARN_ON debido a una entrada no v\u00e1lida. Este problema fue reportado por syzbot. Rechace estos anchos no compatibles al principio de sta_link_apply_parameters() cuando se utilice opmode_notif. El conjunto aceptado incluye 20, 40, 80, 160 y 80+80 MHz, que son v\u00e1lidos para VHT. Si bien 320 MHz no est\u00e1 definido para VHT, se permite evitar rechazar clientes HE o EHT que a\u00fan puedan enviar una notificaci\u00f3n de modo de operaci\u00f3n VHT."
    }
  ],
  "id": "CVE-2025-38509",
  "lastModified": "2026-06-17T09:17:00.790",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-08-16T11:15:43.893",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/18eca59a04500b68a90e0c5c873f97c9d1ea2bfa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/58fcb1b4287ce38850402bb2bb16d09bf77b91d9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.