{"id":"CVE-2025-38512","revision":"57a84ad1d02344969ceb6c993218f580","records":[{"revision":"57a84ad1d02344969ceb6c993218f580","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38512","aliases":[],"title":"wifi: prevent A-MSDU attacks in mesh networks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: prevent A-MSDU attacks in mesh networks\n\nThis patch is a mitigation to prevent the A-MSDU spoofing vulnerability\nfor mesh networks. The initial update to the IEEE 802.11 standard, in\nresponse to the FragAttacks, missed this case (CVE-2025-27558). It can\nbe considered a variant of CVE-2020-24588 but for mesh networks.\n\nThis patch tries to detect if a standard MSDU was turned into an A-MSDU\nby an adversary. This is done by parsing a received A-MSDU as a standard\nMSDU, calculating the length of the Mesh Control header, and seeing if\nthe 6 bytes after this header equal the start of an rfc1042 header. If\nequal, this is a strong indication of an ongoing attack attempt.\n\nThis defense was tested with mac80211_hwsim against a mesh network that\nuses an empty Mesh Address Extension field, i.e., when four addresses\nare used, and when using a 12-byte Mesh Address Extension field, i.e.,\nwhen six addresses are used. Functionality of normal MSDUs and A-MSDUs\nwas also tested, and confirmed working, when using both an empty and\n12-byte Mesh Address Extension field.\n\nIt was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh\nnetworks keep being detected and prevented.\n\nNote that the vulnerability being patched, and the defense being\nimplemented, was also discussed in the following paper and in the\nfollowing IEEE 802.11 presentation:\n\nhttps://papers.mathyvanhoef.com/wisec2025.pdf\nhttps://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx","state":0,"publishedAt":"2025-08-16T10:54:54.285+00:00","modifiedAt":"2026-10-15T21:52:18.147+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/wireless/util.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"79720743421753ff72bfa0d79976c534645b81c1\",\n                            \"lessThan\": \"e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"986e43b19ae9176093da35e0a844e65c8bf9ede7\",\n                            \"lessThan\": \"ec6392061de6681148b63ee6c8744da833498cdd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"986e43b19ae9176093da35e0a844e65c8bf9ede7\",\n                            \"lessThan\": \"e01851f6e9a665a6011b14714b271d3e6b0b8d32\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"986e43b19ae9176093da35e0a844e65c8bf9ede7\",\n                            \"lessThan\": \"6e3b09402cc6c3e3474fa548e8adf6897dda05de\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"986e43b19ae9176093da35e0a844e65c8bf9ede7\",\n                            \"lessThan\": \"737bb912ebbe4571195c56eba557c4d7315b26fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.1.107\",\n                            \"lessThan\": \"6.1.146\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/wireless/util.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.146\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.99\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.39\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15.7\",\n                            \"lessThanOrEqual\": \"6.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80","https://git.kernel.org/stable/c/ec6392061de6681148b63ee6c8744da833498cdd","https://git.kernel.org/stable/c/e01851f6e9a665a6011b14714b271d3e6b0b8d32","https://git.kernel.org/stable/c/6e3b09402cc6c3e3474fa548e8adf6897dda05de","https://git.kernel.org/stable/c/737bb912ebbe4571195c56eba557c4d7315b26fb"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38512","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38512","identifiers":["CVE-2025-38512"]},"retained":false,"historicalAffected":[]}],"coverage":[]}