Bug 2367587 (CVE-2025-37973) - CVE-2025-37973 kernel: wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
Summary: CVE-2025-37973 kernel: wifi: cfg80211: fix out-of-bounds access during multi-...
Keywords:
Status: NEW
Alias: CVE-2025-37973
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-20 17:02 UTC by OSIDB Bzimport
Modified: 2025-05-21 02:54 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-05-20 17:02:12 UTC
In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation

Currently during the multi-link element defragmentation process, the
multi-link element length added to the total IEs length when calculating
the length of remaining IEs after the multi-link element in
cfg80211_defrag_mle(). This could lead to out-of-bounds access if the
multi-link element or its corresponding fragment elements are the last
elements in the IEs buffer.

To address this issue, correctly calculate the remaining IEs length by
deducting the multi-link element end offset from total IEs end offset.


Note You need to log in before you can comment on or make changes to this bug.