Executive brief
A vulnerability in the Linux kernel's Wi-Fi handling could allow an attacker within radio range to disrupt a device's wireless connection. By sending specially crafted management frames that should normally be ignored, an attacker can force a device to change channels or disconnect. This bypasses standard security protections intended to verify the authenticity of these network instructions.
Technical details
A vulnerability exists in the mac80211 wireless stack of the Linux kernel where unicast Beacon frames are not strictly filtered. While IEEE 802.11 standards require Beacon frames to be broadcast, mac80211 would accept unicast Beacons if the 'Protected Frame' bit was set to 1, even if they were not actually protected by a Beacon Integrity Group Temporal Key (BIGTK). An attacker within radio range (Adjacent vector) can exploit this to perform targeted attacks, such as using Channel Switch Announcement (CSA) to force a station to an incorrect channel. The fix implements a strict check to discard any Beacon frame not sent to the broadcast address (A1 field).
Affected products
- Linux Linux Kernel 5.7 to 6.13.y
Timeline
- 2025-12-15: disclosed: Initial patch submission
- 2026-01-14: advisory: CVE published
- 2026-01-19: patched: Final stable tree commits completed
References
- https://git.kernel.org/stable/c/0a59a3895f804469276d188effa511c72e752f35
- https://git.kernel.org/stable/c/193d18f60588e95d62e0f82b6a53893e5f2f19f8
- https://git.kernel.org/stable/c/6e5bff40bb38741e40c33043ba0816fba5f93661
- https://git.kernel.org/stable/c/7b240a8935d554ad36a52c2c37c32039f9afaef2
- https://git.kernel.org/stable/c/88aab153d1528bc559292a12fb5105ee97528e1f
- https://git.kernel.org/stable/c/a21704df4024708be698fb3fd5830d5b113b70e0
- https://git.kernel.org/stable/c/be0974be5c42584e027883ac2af7dab5e950098c