Executive brief
A vulnerability in the Linux kernel's Marvell Wi-Fi driver (mwifiex) can cause system instability or unexpected disconnections when a device is acting as both a Wi-Fi client and an access point simultaneously. This occurs because the system incorrectly processes network management messages intended for other devices, leading to internal kernel warnings. While primarily a stability issue, it could potentially be used by a nearby attacker to disrupt wireless connectivity or cause a denial-of-service state on the affected device.
Technical details
A vulnerability exists in the mwifiex Wi-Fi driver within the Linux kernel when host MLME is enabled in concurrent STA/AP mode. The firmware erroneously forwards disassociation/deauthentication frames intended for the Access Point (AP) interface to the Station (STA) interface. Because the STA interface does not verify if these management frames originate from its own connected AP, it attempts to process them, triggering a WARN_ON() in net/wireless/mlme.c. An attacker within radio range could potentially inject or trigger these frames to cause a denial-of-service (DoS) or disrupt the wireless stack. The fix introduces BSSID validation in mwifiex_process_mgmt_packet() to ensure frames are discarded if they do not originate from the currently associated AP.
Affected products
- Linux Linux Kernel 6.12 to 6.12.39, 6.16.0-rc1+
Timeline
- 2025-07-01: patched: Initial patch submitted by Toradex
- 2025-08-16: advisory: CVE-2025-38505 published