CVE-2021-47251

What it actually does

The vulnerability stems from using compile-time constants instead of frame-type-aware dynamic header length checks in ieee80211_scan_rx, allowing certain 802.11 frames to reach cfg80211 validation that triggers a WARN_ON.

Why it matters to the business

Wireless-enabled Linux systems may experience kernel warnings, instability, or unexpected behavior during Wi-Fi scanning operations, increasing operational risk for large fleets or embedded devices.

How an attack unfolds

An attacker within radio range transmits 802.11 management or data frames whose header length does not match the hard-coded assumption; when the victim interface performs a scan, the frame passes the flawed check and reaches cfg80211, surfacing the validation warning.

How to fix it

Apply the upstream kernel commit that replaces the hard-coded length constants with dynamic frame-type-based determination; rebuild and deploy the patched kernel across all affected distributions.

How to confirm the fix worked

Confirm the presence of the dynamic length calculation logic inside ieee80211_scan_rx and verify that no WARN_ON is emitted when cfg80211 receives frames of varying header sizes.

Typical attack path

1. Position within wireless range of target Linux system
2. Transmit crafted 802.11 frames during active scanning windows
3. Trigger ieee80211_scan_rx path with mismatched header length
4. Observe or force the subsequent cfg80211 validation warning

How to detect it

Search kernel logs and dmesg output for WARN_ON messages originating from cfg80211 that coincide with ieee80211_scan_rx activity; correlate with wireless interface scan events.

What your security team should do

• Prioritize kernel updates on all Wi-Fi-enabled hosts and embedded devices
• Monitor kernel logs for cfg80211 validation warnings as a temporary detection measure
• Limit exposure by disabling unnecessary scanning or using wired interfaces where feasible