CVE-2025-37973

What it actually does

Incorrect length calculation in cfg80211_defrag_mle() when multi-link element or fragments are last in the IEs buffer leads to out-of-bounds memory access.

Why it matters to the business

Wireless networking on Linux systems can become unstable or allow unauthorized code execution, increasing risk on devices handling Wi-Fi connections.

How an attack unfolds

An attacker crafts 802.11 management frames containing multi-link elements positioned at the end of the IEs buffer to trigger the flawed defragmentation logic and cause memory corruption.

How to fix it

Upgrade to fixed kernel versions containing commit 73dde269a1a43e6b1aa92eba13ad2df58bfdd38e or nagvis package 1:1.9.42-1 on Ubuntu 24.10; apply vendor kernel updates immediately.

How to confirm the fix worked

Verify updated kernel commit or package version is installed; test wireless association and IE processing with malformed multi-link elements in a lab environment.

Typical attack path

1. Craft malicious 802.11 frames with multi-link elements at buffer end
2. Force wireless stack to process and defragment the elements
3. Trigger out-of-bounds access in cfg80211_defrag_mle()
4. Achieve memory corruption leading to crash or code execution

How to detect it

Review kernel logs for cfg80211 oops or panic messages during frame processing; examine wireless driver traces for abnormal IE lengths on systems still running vulnerable kernels.

What your security team should do

• Prioritize kernel updates on all Linux systems exposing Wi-Fi interfaces
• Monitor vendor advisories for backported fixes in supported distributions
• Restrict untrusted wireless networks until patches are deployed