Linux Kernel Vulnerability in Wi-Fi Beacon Frame Processing by mac80211

CVE-2025-71127

What is CVE-2025-71127?

A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem allows for improper handling of Beacon frames sent to non-broadcast addresses. According to IEEE standards, Beacon frames are expected to target broadcast addresses. However, the existing logic fails to adequately filter out unicast Beacon frames, potentially enabling malicious actors to exploit this oversight. By sending unicast frames, attackers may be able to manipulate connected stations into undesired actions, such as channel switching. Although the current implementation discards unicast frames when the Protected Frame bit is set to 0, it does not consistently apply this logic when the bit is set to 1, leading to a potential bypass of beacon protection measures. It is essential for developers and system administrators to implement strict filtering to discard all Beacon frames not addressed to the broadcast address to mitigate associated risks.

References