In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: regulatory: improve invalid hints checking
Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regulatory_hint_user() call. Such invalid regulatory hints should be rejected.
While a sanity check from commit 47caf685a685 ("cfg80211: regulatory: reject invalid hints") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons.
1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters.
2) While processing a user regulatory request, between reg_process_hint_user() and regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[].
Syzbot triggers a warning in is_user_regdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check.
Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin letters and nothing else.
[1] Syzbot report: ------------[ cut here ]------------ Unexpected user alpha2: A� WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 Modules linked in: CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_power_efficient crda_timeout_work RIP: 0010:is_user_regdom_saved net/wireless/reg.c:440 [inline] RIP: 0010:restore_alpha2 net/wireless/reg.c:3424 [inline] RIP: 0010:restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 ... Call Trace: <TASK> crda_timeout_work+0x27/0x50 net/wireless/reg.c:542 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | Apr 14, 2025 | Apr 1, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 1, 2025 |
| Suse | — | Upgrade kernel-64kb-optionalUpgrade kernel-azure-vdsoUpgrade kernel-defaultUpgrade reiserfs-kmp-64kbUpgrade dtb-marvellUpgrade kernel-default-baseUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-default-extraUpgrade kernel-rt-extraUpgrade kernel-default-livepatch-develUpgrade dtb-sprdUpgrade reiserfs-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-default-manUpgrade kernel-docsUpgrade dtb-nvidiaUpgrade kernel-macrosUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-debugUpgrade dtb-appleUpgrade dtb-renesasUpgrade dtb-amlogicUpgrade dtb-amdUpgrade kernel-obs-buildUpgrade kernel-syms-rtUpgrade kselftests-kmp-defaultUpgrade kernel-debug-develUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dtb-apmUpgrade dtb-socionextUpgrade gfs2-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-qaUpgrade dtb-hisiliconUpgrade kernel-azure-extraUpgrade dlm-kmp-azureUpgrade dlm-kmp-rtUpgrade dtb-armUpgrade ocfs2-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmall-develUpgrade kernel-azure-develUpgrade kernel-source-azureUpgrade gfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-rtUpgrade kernel-develUpgrade gfs2-kmp-rtUpgrade dtb-amazonUpgrade dtb-rockchipUpgrade dtb-alteraUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-rt-develUpgrade kernel-azure-optionalUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade dlm-kmp-64kbUpgrade dtb-lgUpgrade kernel-rt-optionalUpgrade dtb-mediatekUpgrade kernel-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-source-rtUpgrade kernel-kvmsmallUpgrade dtb-freescaleUpgrade kernel-default-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-syms-azureUpgrade kernel-devel-rtUpgrade kernel-default-optionalUpgrade kernel-default-livepatchUpgrade dtb-exynosUpgrade cluster-md-kmp-azureUpgrade kernel-azureUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-sourceUpgrade kernel-rt_debug-develUpgrade kernel-default-develUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-symsUpgrade dtb-qcomUpgrade ocfs2-kmp-64kbUpgrade dtb-xilinx | Dec 5, 2025 | May 20, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1039-awsUpgrade linux-image-6.8.0-84-genericUpgrade linux-image-ibm-6.8Upgrade linux-image-oem-20.04bUpgrade linux-image-generic-64k-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-84-generic-64kUpgrade linux-image-azureUpgrade linux-image-oem-22.04bUpgrade linux-image-5.4.0-1146-aws-fipsUpgrade linux-image-gke-64k-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-5.15.0-1037-nvidia-tegra-rtUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-1078-raspiUpgrade linux-image-azure-fde-6.11Upgrade linux-image-virtual-6.8Upgrade linux-image-5.15.0-140-lowlatencyUpgrade linux-image-5.15.0-1081-oracleUpgrade linux-image-oem-22.04Upgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-ibmUpgrade linux-image-ibm-classicUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1089-azure-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-nvidiaUpgrade linux-image-5.4.0-1146-awsUpgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1039-nvidia-lowlatency-64kUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-6.8Upgrade linux-image-azure-fdeUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1040-gcpUpgrade linux-image-gcp-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-140-generic-lpaeUpgrade linux-image-gke-5.15Upgrade linux-image-gkeopUpgrade linux-image-nvidia-tegraUpgrade linux-image-aws-lts-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-5.4.0-1120-fipsUpgrade linux-image-6.8.1-1034-realtimeUpgrade linux-image-5.15.0-140-generic-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gke-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-5.15.0-1084-aws-fipsUpgrade linux-image-5.15.0-1037-nvidia-tegraUpgrade linux-image-5.4.0-1051-iotUpgrade linux-image-5.15.0-140-fipsUpgrade linux-image-5.15.0-142-generic-lpaeUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1039-raspiUpgrade linux-image-6.8.0-1023-gkeopUpgrade linux-image-azure-fde-edgeUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-raspi2Upgrade linux-image-5.15.0-1084-realtimeUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1079-intel-iotgUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-64kUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.11.0-28-genericUpgrade linux-image-fipsUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-5.15.0-1077-intel-iot-realtimeUpgrade linux-image-5.4.0-1149-gcp-fipsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-5.4.0-1144-oracleUpgrade linux-image-gke-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-oem-20.04dUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-genericUpgrade linux-image-5.15.0-1083-gcp-fipsUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-lowlatency-6.11Upgrade linux-image-5.15.0-1083-gcpUpgrade linux-image-oem-22.04cUpgrade linux-image-azure-fipsUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-5.15.0-1081-gkeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-azure-6.11Upgrade linux-image-raspiUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-5.15.0-142-genericUpgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-5.4.0-1092-ibmUpgrade linux-image-6.8.0-1037-ibmUpgrade linux-image-aws-fipsUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-6.8.0-1036-azureUpgrade linux-image-aws-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1040-gcp-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-5.4.0-1151-azure-fipsUpgrade linux-image-5.15.0-140-genericUpgrade linux-image-5.15.0-1076-ibmUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-6.8.0-1038-azure-fdeUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.4.0-1149-gcpUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-5.15.0-1026-nvidia-tegra-igx-rtUpgrade linux-image-oem-osp1Upgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-1039-nvidia-64kUpgrade linux-image-5.15.0-1084-awsUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-5.15.0-1078-nvidia-lowlatencyUpgrade linux-image-5.15.0-1078-nvidiaUpgrade linux-image-5.15.0-1066-gkeopUpgrade linux-image-5.15.0-1026-nvidia-tegra-igxUpgrade linux-image-6.8.0-1039-nvidia-lowlatencyUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oracleUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-84-lowlatencyUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-5.15.0-1080-kvmUpgrade linux-image-oracle-64kUpgrade linux-image-5.4.0-1105-bluefieldUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1151-azureUpgrade linux-image-azure-fde-6.8Upgrade linux-image-5.15.0-1089-azureUpgrade linux-image-virtualUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-1039-nvidiaUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-84-lowlatency-64kUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-5.4.0-1064-xilinx-zynqmpUpgrade linux-image-5.15.0-140-lowlatency-64kUpgrade linux-image-5.15.0-1050-xilinx-zynqmpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-bluefieldUpgrade linux-image-intelUpgrade linux-image-gkeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1036-gke-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-oemUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-kvmUpgrade linux-image-aws-lts-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-85-genericUpgrade linux-image-6.8.0-1036-gkeUpgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-6.8.0-1038-azureUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-5.4.0-216-lowlatencyUpgrade linux-image-5.4.0-1133-kvmUpgrade linux-image-5.4.0-216-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-azure-cvmUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-142-generic-64kUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1039-aws-64kUpgrade linux-image-6.8.0-1036-azure-fdeUpgrade linux-image-5.4.0-216-generic-lpaeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-aws | May 20, 2025 | Apr 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Apr 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub