linux-cve-announce - CVE-2025-38644: wifi: mac80211: reject TDLS operations when station is not associated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025082235-CVE-2025-38644-39b4@gregkh>
Date: Fri, 22 Aug 2025 18:00:52 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38644: wifi: mac80211: reject TDLS operations when station is not associated

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: reject TDLS operations when station is not associated

syzbot triggered a WARN in ieee80211_tdls_oper() by sending
NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT,
before association completed and without prior TDLS setup.

This left internal state like sdata->u.mgd.tdls_peer uninitialized,
leading to a WARN_ON() in code paths that assumed it was valid.

Reject the operation early if not in station mode or not associated.

The Linux kernel CVE team has assigned CVE-2025-38644 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.17 with commit 81dd2b8822410e56048b927be779d95a2b6dc186 and fixed in 6.1.148 with commit 0c84204cf0bbe89e454a5caccc6a908bc7db1542
	Issue introduced in 3.17 with commit 81dd2b8822410e56048b927be779d95a2b6dc186 and fixed in 6.6.102 with commit 378ae9ccaea3f445838a087962a067b5cb2e8577
	Issue introduced in 3.17 with commit 81dd2b8822410e56048b927be779d95a2b6dc186 and fixed in 6.12.42 with commit af72badd5ee423eb16f6ad7fe0a62f1b4252d848
	Issue introduced in 3.17 with commit 81dd2b8822410e56048b927be779d95a2b6dc186 and fixed in 6.15.10 with commit 4df663d4c1ca386dcab2f743dfc9f0cc07aef73c
	Issue introduced in 3.17 with commit 81dd2b8822410e56048b927be779d95a2b6dc186 and fixed in 6.16.1 with commit 31af06b574394530f68a4310c45ecbe2f68853c4
	Issue introduced in 3.17 with commit 81dd2b8822410e56048b927be779d95a2b6dc186 and fixed in 6.17-rc1 with commit 16ecdab5446f15a61ec88eb0d23d25d009821db0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38644
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mac80211/tdls.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0c84204cf0bbe89e454a5caccc6a908bc7db1542
	https://git.kernel.org/stable/c/378ae9ccaea3f445838a087962a067b5cb2e8577
	https://git.kernel.org/stable/c/af72badd5ee423eb16f6ad7fe0a62f1b4252d848
	https://git.kernel.org/stable/c/4df663d4c1ca386dcab2f743dfc9f0cc07aef73c
	https://git.kernel.org/stable/c/31af06b574394530f68a4310c45ecbe2f68853c4
	https://git.kernel.org/stable/c/16ecdab5446f15a61ec88eb0d23d25d009821db0