CVE-2025-71224 in Linux
Summary
by MITRE • 02/14/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
ieee80211_ocb_rx_no_sta() assumes a valid channel context, which is only present after JOIN_OCB.
RX may run before JOIN_OCB is executed, in which case the OCB interface is not operational. Skip RX peer handling when the interface is not joined to avoid warnings in the RX path.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/06/2026
The vulnerability identified as CVE-2025-71224 resides within the Linux kernel's mac80211 wireless subsystem, specifically affecting the 802.11 OCB (Other Channel Bandwidth) implementation. This issue represents a race condition and improper state validation scenario that can lead to kernel warnings and potential instability during wireless packet processing. The flaw manifests when the wireless interface transitions through its operational lifecycle, particularly during the period between interface initialization and the completion of the OCB join process. The vulnerability is classified under CWE-362, which deals with race conditions, and specifically relates to improper handling of concurrent operations in kernel space. The mac80211 subsystem serves as the primary wireless networking framework for Linux, managing various 802.11 protocols including OCB mode which allows devices to communicate on non-AP channels without requiring association with an access point.
The technical root cause of this vulnerability stems from the ieee80211_ocb_rx_no_sta() function's assumption that a valid channel context exists for all incoming packets. This function is designed to handle reception of packets from peers when no station context is available, but it fails to account for the fact that the OCB interface may be in a transitional state where the JOIN_OCB operation has not yet completed. During this interim period, the channel context required by the function is not yet established, yet the receive path still attempts to process incoming packets through this function. The improper state checking creates a scenario where kernel warnings are generated when attempting to access channel context data that has not yet been initialized, leading to potential kernel panic conditions or system instability. This behavior directly violates the principle of proper state validation and initialization sequence in kernel drivers.
The operational impact of this vulnerability extends beyond simple warning messages, as it can affect the reliability and stability of wireless networking operations on Linux systems. When the interface is not properly joined to an OCB network, the kernel's wireless subsystem may generate repeated warnings that clutter system logs and potentially indicate deeper operational issues. In environments where wireless connectivity is critical, such as industrial IoT deployments or mobile computing scenarios, this vulnerability could manifest as intermittent connectivity problems or degraded wireless performance. The vulnerability affects systems running Linux kernels that implement the mac80211 subsystem with OCB support, particularly those utilizing wireless hardware that supports the OCB mode for direct device-to-device communication. Attackers could potentially exploit the instability caused by these warnings to trigger denial of service conditions, though the direct attack surface is limited as the issue primarily affects the kernel's internal packet processing logic rather than network-level vulnerabilities.
Mitigation strategies for CVE-2025-71224 focus on implementing proper state validation within the wireless subsystem's receive path. The recommended solution involves adding explicit checks to ensure that the OCB interface is in a joined state before attempting to process packets through the ieee80211_ocb_rx_no_sta() function. This approach aligns with ATT&CK technique T1547.001 which involves the manipulation of system processes and kernel modules to achieve persistence or stability. System administrators should ensure that their Linux kernels are updated to versions that include the fix for this vulnerability, typically through standard package update mechanisms. The fix implemented in the kernel source code involves adding a conditional check to verify that the interface is properly joined before proceeding with the packet processing logic. Organizations should also implement monitoring solutions to detect the appearance of kernel warnings related to wireless packet processing, as these warnings may indicate the presence of the vulnerability or other related issues in the wireless subsystem. Regular kernel updates and security audits of wireless networking components remain essential defensive measures against similar state-related vulnerabilities in kernel space wireless implementations.