https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 20:42:01 +0000 https://vulnerability.circl.lu/vuln/cve-2025-21910 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: cfg80211: regulatory: improve invalid hints checking</p> <p>Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regulatory_hint_user() call. Such invalid regulatory hints should be rejected.</p> <p>While a sanity check from commit 47caf685a685 (&#34;cfg80211: regulatory: reject invalid hints&#34;) looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons.</p> <p>1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters.</p> <p>2) While processing a user regulatory request, between reg_process_hint_user() and regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in request-&gt;alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[].</p> <p>Syzbot triggers a warning in is_user_regdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check.</p> <p>Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin letters and nothing else.</p> <p>[1] Syzbot report: -…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: cfg80211: regulatory: improve invalid hints checking</p> <p>Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regulatory_hint_user() call. Such invalid regulatory hints should be rejected.</p> <p>While a sanity check from commit 47caf685a685 (&#34;cfg80211: regulatory: reject invalid hints&#34;) looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons.</p> <p>1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters.</p> <p>2) While processing a user regulatory request, between reg_process_hint_user() and regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in request-&gt;alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[].</p> <p>Syzbot triggers a warning in is_user_regdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check.</p> <p>Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin letters and nothing else.</p> <p>[1] Syzbot report: -…</p> https://vulnerability.circl.lu/vuln/cve-2025-21910