CVE: CVE-2025-38505
Published: 2025-08-16
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: discard erroneous disassoc frames on STA interface

When operating in concurrent STA/AP mode with host MLME enabled,
the firmware incorrectly sends disassociation frames to the STA
interface when clients disconnect from the AP interface.
This causes kernel warnings as the STA interface processes
disconnect events that don't apply to it:

[ 1303.240540] WARNING: CPU: 0 PID: 513 at net/wireless/mlme.c:141 cfg80211_process_disassoc+0x78/0xec [cfg80211]
[ 1303.250861] Modules linked in: 8021q garp stp mrp llc rfcomm bnep btnxpuart nls_iso8859_1 nls_cp437 onboard_us
[ 1303.327651] CPU: 0 UID: 0 PID: 513 Comm: kworker/u9:2 Not tainted 6.16.0-rc1+ #3 PREEMPT
[ 1303.335937] Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT)
[ 1303.343588] Workqueue: MWIFIEX_RX_WORK_QUEUE mwifiex_rx_work_queue [mwifiex]
[ 1303.350856] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1303.357904] pc : cfg80211_process_disassoc+0x78/0xec [cfg80211]
[ 1303.364065] lr : cfg80211_process_disassoc+0x70/0xec [cfg80211]
[ 1303.370221] sp : ffff800083053be0
[ 1303.373590] x29: ffff800083053be0 x28: [PII_REDACTED] x27: [PII_REDACTED]
[ 1303.380855] x26: [PII_REDACTED] x25: 00000000ffffffff x24: ffff000002c5b8ae
[ 1303.388120] x23: ffff000002c5b884 x22: [PII_REDACTED] x21: [PII_REDACTED]
[ 1303.395382] x20: ffff000002c5b8ae x19: ffff0000064dd408 x18: [PII_REDACTED]
[ 1303.402646] x17: 3a36333a61623a30 x16: 32206d6f72662063 x15: ffff800080bfe048
[ 1303.409910] x14: ffff[PII_REDACTED]00 x13: [PII_REDACTED] x12: [PII_REDACTED]
[ 1303.417173] x11: [PII_REDACTED] x10: ffff[PII_REDACTED]00 x9 : ffff[PII_REDACTED]00
[ 1303.424434] x8 : ffff00003fd9ef40 x7 : ffff0000039fc280 x6 : [PII_REDACTED]
[ 1303.431695] x5 : ffff[PII_REDACTED]d4 x4 : [PII_REDACTED] x3 : [PII_REDACTED]
[ 1303.438956] x2 :[PII_REDACTED]36ba20 x1 : [PII_REDACTED] x0 : 00000000d00479de
[ 1303.446221] Call trace:
[ 1303.448722]  cfg80211_process_disassoc+0x78/0xec [cfg80211] (P)
[ 1303.454894]  cfg80211_rx_mlme_mgmt+0x64/0xf8 [cfg80211]
[ 1303.460362]  mwifiex_process_mgmt_packet+0x1ec/0x460 [mwifiex]
[ 1303.466380]  mwifiex_process_sta_rx_packet+0x1bc/0x2a0 [mwifiex]
[ 1303.472573]  mwifiex_handle_rx_packet+0xb4/0x13c [mwifiex]
[ 1303.478243]  mwifiex_rx_work_queue+0x158/0x198 [mwifiex]
[ 1303.483734]  process_one_work+0x14c/0x28c
[ 1303.487845]  worker_thread+0x2cc/0x3d4
[ 1303.491680]  kthread+0x12c/0x208
[ 1303.495014]  ret_from_fork+0x10/0x20

Add validation in the STA receive path to verify that disassoc/deauth
frames originate from the connected AP. Frames that fail this check
are discarded early, preventing them from reaching the MLME layer and
triggering WARN_ON().

This filtering logic is similar with that used in the
ieee80211_rx_mgmt_disassoc() function in mac80211, which drops
disassoc frames that don't match the current BSSID
(!ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)), ensuring
only relevant frames are processed.

Tested on:
- 8997 with FW 16.68.1.p197
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3b602ddc0df723992721b0d286c90c9bdd755b34; https://git.kernel.org/stable/c/52654cebaac23dae31a9c97ae0da5be649f1ab4d; https://git.kernel.org/stable/c/a963819a121f5dd61e0b39934d8b5dec529da96a