Description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211_rx_assoc_resp() initialises the status and response-IE fields of cfg80211_connect_resp_params from the management frame before proving that the frame is long enough for those offsets. S1G and regular association responses also have different IE offsets, but the S1G path only patched resp_ie after the unsafe initialiser had already run. Defer resp_ie, resp_ie_len, and status to after the link-iteration loop. Use a bool to remember whether the frame is S1G, then validate the appropriate minimum length and set all three fields in a single if/else block. Funnel short-frame and SME-reject cleanup through a shared free_bss label for the abandon paths.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-24T17:17:13.570Z",
  "pubdate": "2026-09-24T17:17:13.570Z",
  "executiveSummary": "The vulnerability is an out-of-bounds memory access flaw identified in the Linux kernel's cfg80211 subsystem. The issue stems from insufficient input validation of management frame lengths within the cfg80211_rx_assoc_resp function.\nBy transmitting a malformed association response frame, an attacker can trigger the kernel to read memory beyond the allocated buffer boundaries for the status code and Information Element (IE) fields.\nThis vulnerability impacts systems utilizing the cfg80211 wireless configuration framework. The risk implications include potential kernel memory disclosure or system instability leading to a denial-of-service (DoS) condition.\nSuccessful exploitation requires the attacker to be within radio range of the target, acting as a malicious access point or a man-in-the-middle node, to inject crafted management frames during the association process.\nNo specific authentication is required, as the vulnerability is triggered during the early stages of frame processing, potentially bypassing subsequent security checks.",
  "technicalDetails": "The vulnerability is located in the cfg80211_rx_assoc_resp function within the Linux kernel, specifically where management frame data is parsed to initialize the cfg80211_connect_resp_params structure.\nThe root cause is a failure to perform adequate boundary checking on the incoming association response frame before attempting to access fields such as the 'status' code and the 'resp_ie' (Information Element) data. The function currently initializes these fields from the frame buffer at fixed offsets prior to verifying that the actual length of the received packet is sufficient to encompass these offsets.\nFurthermore, the logic incorrectly handles the difference in IE offsets between standard association responses and S1G (Sub-1 GHz) association responses. The implementation attempts to patch the 'resp_ie' pointer only after the initial, unsafe access has already occurred, leading to a race-like condition where invalid pointers may be dereferenced.\nThe attack flow proceeds as follows: 1) The attacker transmits a maliciously crafted, undersized association response frame (or a frame with an S1G header that does not match expected length requirements). 2) The victim's kernel invokes cfg80211_rx_assoc_resp to process the frame. 3) Due to the lack of early validation, the kernel reads 'status' and 'resp_ie' from an offset within the frame that exceeds the actual frame size. 4) If the calculated offset points into unmapped memory, a kernel panic or page fault occurs, causing a denial-of-service. If it points to existing kernel memory, it may lead to the processing of attacker-controlled data as legitimate connection parameters, potentially facilitating further exploitation or silent data corruption.\nThe remediation involves deferring the assignment of 'resp_ie', 'resp_ie_len', and 'status' fields until after the link-iteration loop has been completed. By using a boolean flag to track the S1G state of the frame, the kernel can now validate the frame's length against the specific requirements for either S1G or standard frames before committing the pointers. The inclusion of a shared 'free_bss' label ensures that even in short-frame or SME-reject scenarios, memory associated with the BSS entry is handled correctly, preventing memory leaks during the abandonment of the frame processing flow."
}