CVE-2025-38644

wifi: mac80211: reject TDLS operations when station is not associated

State: Published
Severity: Not scored
Published: Aug 22, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: reject TDLS operations when station is not associated

syzbot triggered a WARN in ieee80211_tdls_oper() by sending NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT, before association completed and without prior TDLS setup.

This left internal state like sdata->u.mgd.tdls_peer uninitialized, leading to a WARN_ON() in code paths that assumed it was valid.

Reject the operation early if not in station mode or not associated.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	81dd2b8822410e56048b927be779d95a2b6dc186 to before 0c84204cf0bbe89e454a5caccc6a908bc7db1542Affected 81dd2b8822410e56048b927be779d95a2b6dc186 to before 378ae9ccaea3f445838a087962a067b5cb2e8577Affected 81dd2b8822410e56048b927be779d95a2b6dc186 to before af72badd5ee423eb16f6ad7fe0a62f1b4252d848Affected 81dd2b8822410e56048b927be779d95a2b6dc186 to before 4df663d4c1ca386dcab2f743dfc9f0cc07aef73cAffected 81dd2b8822410e56048b927be779d95a2b6dc186 to before 31af06b574394530f68a4310c45ecbe2f68853c4Affected 81dd2b8822410e56048b927be779d95a2b6dc186 to before 16ecdab5446f15a61ec88eb0d23d25d009821db0Affected
LinuxLinux	3.17Affected before 3.17Not affected 6.1.148 through 6.1.Not affected 6.6.102 through 6.6.Not affected 6.12.42 through 6.12.Not affected 6.15.10 through 6.15.Not affected 6.16.1 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

81dd2b8822410e56048b927be779d95a2b6dc186 to before 0c84204cf0bbe89e454a5caccc6a908bc7db1542Affected
81dd2b8822410e56048b927be779d95a2b6dc186 to before 378ae9ccaea3f445838a087962a067b5cb2e8577Affected
81dd2b8822410e56048b927be779d95a2b6dc186 to before af72badd5ee423eb16f6ad7fe0a62f1b4252d848Affected
81dd2b8822410e56048b927be779d95a2b6dc186 to before 4df663d4c1ca386dcab2f743dfc9f0cc07aef73cAffected
81dd2b8822410e56048b927be779d95a2b6dc186 to before 31af06b574394530f68a4310c45ecbe2f68853c4Affected
81dd2b8822410e56048b927be779d95a2b6dc186 to before 16ecdab5446f15a61ec88eb0d23d25d009821db0Affected

LinuxLinux

3.17Affected
before 3.17Not affected
6.1.148 through 6.1.*Not affected
6.6.102 through 6.6.*Not affected
6.12.42 through 6.12.*Not affected
6.15.10 through 6.15.*Not affected
6.16.1 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.