CVE-2021-47602

What it actually does

The flaw permits admission control logic to process non-QoS nullfunc frames, resulting in access to an uninitialized QoS control field in the 802.11 header.

Why it matters to the business

Wireless networking stacks on affected Linux systems may experience crashes or undefined behavior, reducing device stability and availability in Wi-Fi environments.

How an attack unfolds

An attacker in range of a vulnerable mac80211 station crafts and transmits non-QoS nullfunc frames; the kernel's admission control path dereferences uninitialized memory, potentially leading to a crash or information exposure.

How to fix it

Apply the upstream commit that restricts admission control processing exclusively to QoS data frames; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the patch that adds an explicit QoS-data-frame check before accessing the QoS header; re-run syzbot-style fuzzing or kernel static-analysis tools targeting the admission control path.

Typical attack path

1. Establish proximity to a target 802.11 interface running the vulnerable mac80211 code
2. Transmit specially formatted non-QoS null data frames that reach the admission control handler
3. Trigger the uninitialized-value read when the frame is incorrectly treated as QoS data
4. Observe kernel panic, oops, or memory disclosure on the target

How to detect it

Review kernel logs for oops or warnings originating from mac80211 admission control paths; inspect 802.11 frame captures for non-QoS nullfunc frames arriving during association or power-save states.

What your security team should do

• Prioritize kernel updates on all systems exposing 802.11 interfaces
• Monitor vendor advisories for backported fixes in distribution kernels
• Limit exposure by disabling unnecessary wireless interfaces until patches are applied