CVE-2021-47611

What it actually does

Missing check for extended element ID presence before parsing in mac80211 allows malformed 802.11 frames to reach unsafe element handling code.

Why it matters to the business

Wireless networking code on Linux systems may experience crashes or unexpected behavior when processing invalid frames, increasing operational risk for any device using affected kernels in Wi-Fi environments.

How an attack unfolds

An attacker crafts a management or action frame containing an extended element without the required ID field and transmits it over the air to a vulnerable receiver; the kernel proceeds to parse the incomplete structure, potentially leading to invalid memory access.

How to fix it

Apply the upstream kernel commit that adds the extended element ID presence check; rebuild and deploy updated kernels to all affected systems; prioritize devices in wireless-heavy environments given the age of the issue.

How to confirm the fix worked

Confirm the presence of the validation check in mac80211 code or verify the kernel version incorporates the fix; test by replaying frames lacking the extended ID and confirming no crash occurs.

Typical attack path

1. Identify target running vulnerable mac80211-based wireless stack
2. Craft 802.11 frame with extended element header missing ID byte
3. Transmit frame to target interface
4. Trigger parsing path that assumes ID is always present

How to detect it

Search kernel logs for mac80211 parsing warnings or oops related to element handling; inspect wireless frame captures for extended elements without ID fields; correlate with any crashes in cfg80211 or mac80211 modules.

What your security team should do

• Patch all Linux systems with wireless support to a kernel containing the validation fix
• Monitor for wireless driver stability issues until patches are deployed
• Review wireless exposure of high-value assets and reduce unnecessary 802.11 interfaces