Executive brief
A vulnerability in the Linux kernel's wireless networking component could allow a local user to cause a system crash or potentially access sensitive information. The issue stems from how the system handles Sub-1 GHz (S1G) Wi-Fi capabilities during network scanning, which can lead to a failure in validating memory buffer lengths. This flaw primarily impacts the reliability of Wi-Fi hardware scanning and overall system stability.
Technical details
A vulnerability exists in the mac80211 wireless configuration framework within the Linux kernel due to an incorrect calculation of scan Information Element (IE) lengths. Specifically, the S1G (Sub-1 GHz) capability element was not accounted for in 'scan_ies_len', leading to a buffer length validation failure in 'ieee80211_prep_hw_scan()' and a subsequent kernel warning/crash in '__ieee80211_start_scan()'. A local attacker with basic privileges could trigger this condition to cause a Denial of Service (DoS) or potentially read out-of-bounds memory. Patches have been released for stable kernel branches including 6.6.108, 6.12.49, and 6.16.9.
Affected products
- Linux Linux Kernel 6.4 to 6.6.107, 6.7 to 6.12.48, 6.13 to 6.16.8
Timeline
- 2025-08-26: patched: Initial fix commit in main branch
- 2025-10-09: disclosed: CVE published