CVE-2025-38509 Information

Aug 17, 2025 cve

Description

In the Linux kernel the following vulnerability has been resolved:

wifi: mac80211: reject VHT opmode for unsupported channel widths

VHT operating mode notifications are not defined for channel widths below 20 MHz. In particular 5 MHz and 10 MHz are not valid under the VHT specification and must be rejected.

Without this check malformed notifications using these widths may reach ieee80211_chan_width_to_rx_bw() leading to a WARN_ON due to invalid input. This issue was reported by syzbot.

Reject these unsupported widths early in sta_link_apply_parameters() when opmode_notif is used. The accepted set includes 20 40 80 160 and 80+80 MHz which are valid for VHT. While 320 MHz is not defined for VHT it is allowed to avoid rejecting HE or EHT clients that may still send a VHT opmode notification.

Reference

https://git.kernel.org/stable/c/18eca59a04500b68a90e0c5c873f97c9d1ea2bfa https://git.kernel.org/stable/c/58fcb1b4287ce38850402bb2bb16d09bf77b91d9

CNNVD-202508-1926 (Published: 2025-08-16)

Share on: