CVE-2025-71227 (GCVE-0-2025-71227)

Vulnerability from cvelistv5 – Published: 2026-02-18 14:21 – Updated: 2026-05-11 21:56
VLAI
Title
wifi: mac80211: don't WARN for connections on invalid channels
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't WARN for connections on invalid channels It's not clear (to me) how exactly syzbot managed to hit this, but it seems conceivable that e.g. regulatory changed and has disabled a channel between scanning (channel is checked to be usable by cfg80211_get_ies_channel_number) and connecting on the channel later. With one scenario that isn't covered elsewhere described above, the warning isn't good, replace it with a (more informative) error message.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f2d9d270c15ae0139b54a7e7466d738327e97e03 , < 10d3ff7e5812c8d70300f6fa8f524009a06aa7e1 (git)
Affected: f2d9d270c15ae0139b54a7e7466d738327e97e03 , < 99067b58a408a384d2a45c105eb3dce980a862ce (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.8
Unaffected: 0 , < 3.8 (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10d3ff7e5812c8d70300f6fa8f524009a06aa7e1",
              "status": "affected",
              "version": "f2d9d270c15ae0139b54a7e7466d738327e97e03",
              "versionType": "git"
            },
            {
              "lessThan": "99067b58a408a384d2a45c105eb3dce980a862ce",
              "status": "affected",
              "version": "f2d9d270c15ae0139b54a7e7466d738327e97e03",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t WARN for connections on invalid channels\n\nIt\u0027s not clear (to me) how exactly syzbot managed to hit this,\nbut it seems conceivable that e.g. regulatory changed and has\ndisabled a channel between scanning (channel is checked to be\nusable by cfg80211_get_ies_channel_number) and connecting on\nthe channel later.\n\nWith one scenario that isn\u0027t covered elsewhere described above,\nthe warning isn\u0027t good, replace it with a (more informative)\nerror message."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:56:48.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10d3ff7e5812c8d70300f6fa8f524009a06aa7e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/99067b58a408a384d2a45c105eb3dce980a862ce"
        }
      ],
      "title": "wifi: mac80211: don\u0027t WARN for connections on invalid channels",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71227",
    "datePublished": "2026-02-18T14:21:48.422Z",
    "dateReserved": "2026-02-14T16:26:02.970Z",
    "dateUpdated": "2026-05-11T21:56:48.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71227",
      "date": "2026-09-28",
      "epss": "0.00104",
      "percentile": "0.00937"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T02:55:07.000Z",
      "cve": "CVE-2025-71227",
      "id": "msrc_CVE-2025-71227",
      "initial_release_date": "2026-02-21T04:27:25.000Z",
      "product_status:known_affected": "16",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: mac80211: don\u0027t WARN for connections on invalid channels",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-71227.json",
      "version": "16"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/mac80211/mlme.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "10d3ff7e5812c8d70300f6fa8f524009a06aa7e1",
                    "status": "affected",
                    "version": "f2d9d270c15ae0139b54a7e7466d738327e97e03",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "99067b58a408a384d2a45c105eb3dce980a862ce",
                    "status": "affected",
                    "version": "f2d9d270c15ae0139b54a7e7466d738327e97e03",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/mac80211/mlme.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.8"
                  },
                  {
                    "lessThan": "3.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F873268-7218-45AB-893B-13DC64693383",
                    "versionEndExcluding": "6.18.10",
                    "versionStartIncluding": "3.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t WARN for connections on invalid channels\n\nIt\u0027s not clear (to me) how exactly syzbot managed to hit this,\nbut it seems conceivable that e.g. regulatory changed and has\ndisabled a channel between scanning (channel is checked to be\nusable by cfg80211_get_ies_channel_number) and connecting on\nthe channel later.\n\nWith one scenario that isn\u0027t covered elsewhere described above,\nthe warning isn\u0027t good, replace it with a (more informative)\nerror message."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: mac80211: no advertir para conexiones en canales inv\u00e1lidos\n\nNo est\u00e1 claro (para m\u00ed) c\u00f3mo exactamente syzbot logr\u00f3 activar esto,\npero parece concebible que, por ejemplo, la regulaci\u00f3n cambi\u00f3 y ha\ndeshabilitado un canal entre el escaneo (se verifica que el canal sea\nutilizable por cfg80211_get_ies_channel_number) y la conexi\u00f3n en\nel canal m\u00e1s tarde.\n\nCon un escenario que no est\u00e1 cubierto en otro lugar descrito anteriormente,\nla advertencia no es buena, reempl\u00e1zala con un mensaje de error (m\u00e1s informativo)."
          }
        ],
        "id": "CVE-2025-71227",
        "lastModified": "2026-06-17T10:03:54.660",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-02-18T15:18:40.563",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/10d3ff7e5812c8d70300f6fa8f524009a06aa7e1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/99067b58a408a384d2a45c105eb3dce980a862ce"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:13:03+00:00",
      "cve": "CVE-2025-71227",
      "id": "CVE-2025-71227",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: don\u0027t WARN for connections on invalid channels",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71227.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:15:04Z",
      "cve": "CVE-2025-71227",
      "id": "CVE-2025-71227",
      "initial_release_date": "2026-02-19T00:28:51Z",
      "product_status:known_affected": "286",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71227",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71227.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.