CVE-2025-38644

wifi: mac80211: reject TDLS operations when station is not associated

published August 22, 2025

CVSS
—
EPSS
0%
Percentile
5.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: reject TDLS operations when station is not associated

syzbot triggered a WARN in ieee80211_tdls_oper() by sending

NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT,

before association completed and without prior TDLS setup.

This left internal state like sdata->u.mgd.tdls_peer uninitialized,

leading to a WARN_ON() in code paths that assumed it was valid.

Reject the operation early if not in station mode or not associated.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.7th percentile
Published
2025-08-22T16:00Z
EPSS history
Timeline
  • 22 AUG 16:00Z
    wifi: mac80211: reject TDLS operations when station is not associated
    cvelistv5