CVE-2025-38512: Linux Kernel Mesh Network Spoofing Flaw

CVE-2025-38512 Overview

CVE-2025-38512 is a Wi-Fi frame handling vulnerability in the Linux kernel affecting mesh networks. The flaw allows an adversary to convert a standard MAC Service Data Unit (MSDU) into an Aggregated MSDU (A-MSDU), enabling frame injection attacks. This issue is a mesh-network variant of the FragAttacks class (CVE-2020-24588) and shares its root cause with CVE-2025-27558, which the initial IEEE 802.11 standard update missed.

The vulnerability affects the mac80211 subsystem in the Linux kernel prior to the fix, including 6.16 release candidates and earlier stable branches. Debian Linux 11 is also impacted.

Critical Impact
An adversary within Wi-Fi range of a mesh network can inject arbitrary network traffic by spoofing A-MSDU frames, potentially leading to traffic redirection or exploitation of downstream services.

Affected Products

Linux kernel stable branches prior to the patched commits
Linux kernel 6.16-rc1 through 6.16-rc5
Debian Linux 11.0

Discovery Timeline

2025-08-16 - CVE-2025-38512 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38512

Vulnerability Analysis

The vulnerability resides in the Linux kernel Wi-Fi stack that processes A-MSDU frames on mesh interfaces. A-MSDU is an aggregation feature defined by IEEE 802.11 that packs multiple MSDUs into a single MAC frame to improve throughput. When the receiving station cannot reliably distinguish a legitimate A-MSDU from a spoofed one, an attacker can inject crafted frames that the kernel decapsulates into multiple attacker-controlled Ethernet frames.

The original defense introduced in response to FragAttacks did not account for mesh networks, which include a Mesh Control header and can carry either four or six addresses via the Mesh Address Extension field. Because the mesh header length varies, prior detection logic did not identify the malicious frames.

Root Cause

The root cause is missing input validation in mesh A-MSDU decapsulation logic within mac80211. The IEEE 802.11 standard update following FragAttacks did not extend A-MSDU spoofing protections to mesh frames. As a result, a standard MSDU converted into an A-MSDU by an attacker is accepted and processed by the kernel without integrity checks specific to the mesh frame format.

Attack Vector

Exploitation requires the attacker to be within radio range of a mesh network participant and able to inject or manipulate wireless frames. The attacker crafts a frame that appears as an A-MSDU but whose payload, when parsed as a standard MSDU with a Mesh Control header, contains a valid rfc1042 header six bytes after the mesh header. Successful spoofing lets the attacker inject Ethernet frames into the victim's network stack, enabling traffic injection or manipulation.

No public proof-of-concept exploit is listed in the CVE data. The technical analysis and defense approach are documented in the referenced WiSec 2025 paper and IEEE 802.11 working group presentation.

Detection Methods for CVE-2025-38512

Indicators of Compromise

Kernel log messages from mac80211 indicating dropped A-MSDU frames on mesh interfaces after applying the patch
Unexpected A-MSDU frames received on mesh interfaces from stations that do not typically send aggregated frames
Wireless captures showing A-MSDU frames whose decapsulated payload contains an rfc1042 header at the offset immediately following a Mesh Control header

Detection Strategies

Inspect Wi-Fi captures with tools such as Wireshark, filtering on mesh frames with the A-MSDU-present bit set, and validate the inner headers for rfc1042 signatures at suspicious offsets
Monitor kernel ring buffer output via dmesg for entries from the mac80211 subsystem that reference discarded aggregated frames
Correlate wireless anomalies with downstream network events such as unexpected ARP, DHCP, or DNS traffic originating from mesh peers

Monitoring Recommendations

Aggregate kernel logs from mesh nodes into a centralized log platform and alert on new mac80211 drop events after patch deployment
Track patch state and kernel version across all mesh-capable Linux endpoints to verify remediation coverage
Baseline normal A-MSDU volumes per mesh peer and alert on deviations that may indicate injection attempts

How to Mitigate CVE-2025-38512

Immediate Actions Required

Apply the upstream mac80211 patches referenced by the kernel commits 6e3b0940, 737bb912, e01851f6, e2c8a3c0, and ec639206
Update Debian 11 systems using the Debian LTS Announcement advisory
Inventory all Linux hosts running mesh mode via iw dev and prioritize patching for those systems

Patch Information

The fix is committed to the mainline Linux kernel and backported to stable branches. It detects A-MSDU spoofing by parsing the received A-MSDU as a standard MSDU, computing the length of the Mesh Control header, and checking whether the six bytes after the header equal the start of an rfc1042 header. If so, the frame is dropped. Refer to the vendor advisories for the specific commits: Kernel Commit 6e3b0940, Kernel Commit 737bb912, Kernel Commit e01851f6, Kernel Commit e2c8a3c0, and Kernel Commit ec639206.

Workarounds

Disable IEEE 802.11s mesh mode on affected systems until the patch is applied where operationally feasible
Restrict mesh network membership using strong Simultaneous Authentication of Equals (SAE) credentials to limit exposure to unauthenticated adversaries in radio range
Segment mesh-connected devices from sensitive network segments so that injected frames cannot reach critical services

bash

# Verify running kernel version and mesh interfaces
uname -r
iw dev | awk '/Interface/ {iface=$2} /type mesh/ {print iface}'

# Example: temporarily disable a mesh interface
sudo ip link set dev mesh0 down