High · published June 18, 2025
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Fix UAF in ieee80211_scan_rx()
ieee80211_scan_rx() tries to access scan_req->flags after a
null check, but a UAF is observed when the scan is completed
and __ieee80211_scan_completed() executes, which then calls
cfg80211_scan_done() leading to the freeing of scan_req.
Since scan_req is rcu_dereference()'d, prevent the racing in
__ieee80211_scan_completed() by ensuring that from mac80211's
POV it is no longer accessed from an RCU read critical section
before we call cfg80211_scan_done().
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 3.19, < 4.9.330 | 4.9.330 |
| linux/linux_kernel | ≥ 4.10, < 4.14.295 | 4.14.295 |
| linux/linux_kernel | ≥ 4.15, < 4.19.260 | 4.19.260 |
| linux/linux_kernel | ≥ 4.20, < 5.4.215 | 5.4.215 |
| linux/linux_kernel | ≥ 5.5, < 5.10.142 | 5.10.142 |
| linux/linux_kernel | ≥ 5.11, < 5.15.66 | 5.15.66 |
| linux/linux_kernel | ≥ 5.16, < 5.19.8 | 5.19.8 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |