CVE-2025-27558

What it actually does

The flaw allows injection of arbitrary frames into WPA/WPA2/WPA3 or WEP mesh networks by exploiting incorrect handling of non-SSP A-MSDU frames on devices that accept them, due to an incomplete fix for a prior FragAttacks issue.

Why it matters to the business

Mesh network deployments risk unauthorized data injection or manipulation that can lead to confidentiality or integrity breaches without requiring credentials or user interaction.

How an attack unfolds

An attacker within radio range identifies mesh participants accepting non-SSP A-MSDU frames and transmits crafted frames that bypass authorization checks, achieving direct delivery to target devices.

How to fix it

Upgrade linux-lts (Alpaquita:23) to 6.1.81-r0 or later, linux-lts (Alpaquita:stream) to 6.6.58-r0 or 6.12.41-r0, and linux-lts (Alpaquita:25) to 6.12.41-r0. Apply corresponding patches to IEEE 802.11 mesh implementations and verify A-MSDU frame processing.

How to confirm the fix worked

Confirm installed kernel versions meet or exceed the listed fixed releases for each affected product. Audit mesh configurations and test A-MSDU acceptance behavior against the updated standard.

Typical attack path

1. Position within wireless range of the target mesh network
2. Identify devices supporting non-SSP A-MSDU reception under WPA/WPA2/WPA3 or WEP
3. Craft malicious A-MSDU frames exploiting the flawed handling
4. Transmit frames to inject arbitrary content toward target devices

How to detect it

Inspect wireless packet captures and device logs for unexpected A-MSDU frame patterns or injection attempts that bypass mesh authorization checks.

What your security team should do

• Apply the listed kernel updates to all affected wireless mesh systems
• Review and harden A-MSDU configuration options where supported
• Monitor vendor advisories for additional 802.11 mesh firmware fixes