LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71127: wifi: mac80211: Discard Beacon frames to non-broadcast address

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Discard Beacon frames to non-broadcast address Beacon frames are required to be sent to the broadcast address, see IEEE Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the Beacon .. frame shall be set to the broadcast address"). A unicast Beacon frame might be used as a targeted attack to get one of the associated STAs to do something (e.g., using CSA to move it to another channel). As such, it is better have strict filtering for this on the received side and discard all Beacon frames that are sent to an unexpected address. This is even more important for cases where beacon protection is used. The current implementation in mac80211 is correctly discarding unicast Beacon frames if the Protected Frame bit in the Frame Control field is set to 0. However, if that bit is set to 1, the logic used for checking for configured BIGTK(s) does not actually work. If the driver does not have logic for dropping unicast Beacon frames with Protected Frame bit 1, these frames would be accepted in mac80211 processing as valid Beacon frames even though they are not protected. This would allow beacon protection to be bypassed. While the logic for checking beacon protection could be extended to cover this corner case, a more generic check for discard all Beacon frames based on A1=unicast address covers this without needing additional changes. Address all these issues by dropping received Beacon frames if they are sent to a non-broadcast address.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A nearby attacker may send improperly addressed Wi-Fi beacon frames that Linux accepts as legitimate. This could redirect a connected device to another channel or disrupt wireless availability. The flaw can also bypass beacon protection under specific driver behavior. It does not require credentials or user interaction, but the attacker must be within radio range.

Executive priority

Treat this as a prompt patch-assessment item for Linux fleets that depend on Wi-Fi, especially mobile, operational, or availability-sensitive systems. It is high severity but proximity-limited, with no supplied evidence of active exploitation. Prioritize confirmed mac80211 exposure and vendor-supported updates rather than emergency organization-wide isolation.

Technical view

Linux mac80211 did not universally reject Beacon frames whose Address 1 field was non-broadcast. Protected-bit unicast Beacons could pass mac80211 validation when the driver lacked equivalent filtering, bypassing beacon protection. The stable-kernel fix discards received Beacon frames sent to any non-broadcast address. CVSS 3.1 is 7.1, reflecting adjacent access, low complexity, low integrity impact, and high availability impact.

Likely exposure

Exposure is most likely on Linux devices operating as Wi-Fi stations through mac80211, particularly with beacon protection enabled and drivers that do not independently discard unicast Beacons. Exploitation requires proximity within effective Wi-Fi radio range. The bundled version information contains unusual and ambiguous entries, so vendor-specific kernel backport status must determine actual exposure.

Exploitation context

The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or public weaponization. The described attack is proximity-based: an unauthenticated nearby transmitter could target an associated station with a crafted Beacon. Potential outcomes include unauthorized channel changes and wireless disruption rather than confidentiality loss.

Researcher notes

No CWE is assigned in the supplied record. The central condition is acceptance of non-broadcast Beacon frames, including a protected-bit corner case where BIGTK checking was ineffective. Stable commits demonstrate remediation, but the supplied affected-version representation is insufficient for reliable boundary analysis. Researchers should correlate distribution kernels and backports without assuming upstream version numbers directly represent exposure.

Mitigation direction

  • Apply the Linux distribution or device vendor update containing the applicable stable-kernel fix.
  • Use the cited stable commits to verify whether a vendor kernel includes the backport.
  • Prioritize Wi-Fi clients using mac80211, especially where beacon protection is enabled.
  • If updating is delayed, consult vendor guidance; the sources name no separate workaround.

Validation and detection

  • Inventory Linux systems with active Wi-Fi interfaces and record kernel, distribution, and firmware versions.
  • Confirm each vendor kernel includes the relevant stable commit or an equivalent backport.
  • Review vendor advisories because the bundled affected-version list contains ambiguous and unusual entries.
  • After updating, verify normal Wi-Fi association and channel-switch behavior in an authorized test environment.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71127 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H2.84.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2025-71127Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxaf2d14b01c32d7cba65f73503586e5b621afb139, af2d14b01c32d7cba65f73503586e5b621afb139, af2d14b01c32d7cba65f73503586e5b621afb139, af2d14b01c32d7cba65f73503586e5b621afb139, af2d14b01c32d7cba65f73503586e5b621afb139, af2d14b01c32d7cba65f73503586e5b621afb139, af2d14b01c32d7cba65f73503586e5b621afb139unaffected
LinuxLinux5.7, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65, 6.18.4, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.