CVE-2025-38509

wifi: mac80211: reject VHT opmode for unsupported channel widths

published August 16, 2025

CVSS
—
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: reject VHT opmode for unsupported channel widths

VHT operating mode notifications are not defined for channel widths

below 20 MHz. In particular, 5 MHz and 10 MHz are not valid under the

VHT specification and must be rejected.

Without this check, malformed notifications using these widths may

reach ieee80211_chan_width_to_rx_bw(), leading to a WARN_ON due to

invalid input. This issue was reported by syzbot.

Reject these unsupported widths early in sta_link_apply_parameters()

when opmode_notif is used. The accepted set includes 20, 40, 80, 160,

and 80+80 MHz, which are valid for VHT. While 320 MHz is not defined

for VHT, it is allowed to avoid rejecting HE or EHT clients that may

still send a VHT opmode notification.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00131 · 2.5th percentile
Published
2025-08-16T10:54Z
EPSS history
Timeline
  • 16 AUG 10:54Z
    wifi: mac80211: reject VHT opmode for unsupported channel widths
    cvelistv5