CVE-2025-38013: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Set nchannels after allocating struct cfg80211scanrequest
Make sure that nchannels is set after allocating the struct cfg80211registereddevice::intscanreq member. Seen with syzkaller:
UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211channel [] countedby(nchannels)' (aka 'struct ieee80211channel []')
This was missed in the initial conversions because I failed to locate the allocation likely due to the "sizeof(void )" not matching the "channels" array type.
Affected Software
Remediation
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the affected mac80211 Wi-Fi scanning code are exposed. The issue is in the kernel's Wi-Fi subsystem rather than in a userspace application.
What level of access would an attacker need?
The CVSS vector indicates that local access and low privileges are required. No user interaction is required.
What is the likely impact of successful exploitation?
The issue is an out-of-bounds read in mac80211 scan handling. The supplied CVSS assessment rates confidentiality, integrity, and availability impact as high.
How can I tell whether a system has encountered the issue?
A triggered condition may produce a UBSAN array-index-out-of-bounds report in net/mac80211/scan.c at line 1208, involving index 0 and the channels array counted by n_channels.
What should be done to remediate it?
Apply the available Linux kernel patch. The fix ensures n_channels is set only after allocation of the cfg80211_registered_device::int_scan_req scan-request structure.