cbcvebase.
CVE-2025-21910
published 2025-04-01

CVE-2025-21910: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: regulatory: improve invalid hints checking Syzbot keeps reporting an issue…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.1th percentile
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: regulatory: improve invalid hints checking Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regulatory_hint_user() call. Such invalid regulatory hints should be rejected. While a sanity check from commit 47caf685a685 ("cfg80211: regulatory: reject invalid hints") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons. 1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters. 2) While processing a user regulatory request, between reg_process_hint_user() and regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[]. Syzbot triggers a warning in is_user_regdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check. Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin letters and nothing else. [1] Syzbot report: ------------[ cut here ]------------ Unexpected user alpha2: A� WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 Modules linked in: CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Har

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
debianlinux-6.1< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
linuxlinux
linuxlinux>= 09d989d179d0c679043556dda77c51b41a2dae7e < 62b1a9bbfebba4b4c2bb6c1ede9ef7ecee7a9ff662b1a9bbfebba4b4c2bb6c1ede9ef7ecee7a9ff6
linuxlinux>= 09d989d179d0c679043556dda77c51b41a2dae7e < da3f599517ef2ea851208df3229d07728d238dc5da3f599517ef2ea851208df3229d07728d238dc5
linuxlinux>= 09d989d179d0c679043556dda77c51b41a2dae7e < 6a5e3b23054cee3b92683d1467e3fa83921f56226a5e3b23054cee3b92683d1467e3fa83921f5622
linuxlinux>= 09d989d179d0c679043556dda77c51b41a2dae7e < f4112cb477c727a65787a4065a75ca593bb5b2f4f4112cb477c727a65787a4065a75ca593bb5b2f4
linuxlinux>= 09d989d179d0c679043556dda77c51b41a2dae7e < 35ef07112b61b06eb30683a6563c9f6378c0247635ef07112b61b06eb30683a6563c9f6378c02476
linuxlinux>= 09d989d179d0c679043556dda77c51b41a2dae7e < be7c5f00aa7f1344293e4d48d0e12be83a2f223dbe7c5f00aa7f1344293e4d48d0e12be83a2f223d
linuxlinux>= 09d989d179d0c679043556dda77c51b41a2dae7e < 17aa34c84867f6cd181a5743e1c647e7766962a617aa34c84867f6cd181a5743e1c647e7766962a6
linuxlinux>= 09d989d179d0c679043556dda77c51b41a2dae7e < 59b348be7597c4a9903cb003c69e37df20c04a3059b348be7597c4a9903cb003c69e37df20c04a30
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.237-15.10.237-1
linuxlinux_kernel>= 0 < 6.1.133-16.1.133-1
linuxlinux_kernel>= 0 < 6.12.19-16.12.19-1
linuxlinux_kernel>= 0 < 6.12.19-16.12.19-1
linuxlinux_kernel>= 0 < 5.4.0-216.2365.4.0-216.236
linuxlinux_kernel>= 0 < 5.15.0-140.1505.15.0-140.150
linuxlinux_kernel>= 0 < 6.8.0-84.846.8.0-84.84
linuxlinux_kernel>= 2.6.34 < 5.4.2915.4.291
linuxlinux_kernel>= 5.11 < 5.15.1795.15.179
linuxlinux_kernel>= 5.16 < 6.1.1316.1.131
linuxlinux_kernel>= 5.5 < 5.10.2355.10.235
linuxlinux_kernel>= 6.13 < 6.13.76.13.7
linuxlinux_kernel>= 6.2 < 6.6.836.6.83

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.