Insufficient verification of data authenticity in IEEE 802.11 - CVE-2025-27558

Vulnerability identifier: #VU114098

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-27558

CWE-ID: CWE-345

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an attacker to perform spoofing attack.

The vulnerability exists due to insufficient verification of data authenticity in mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP). A remote attacker on the local network can inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames and perform spoofing attack.

IEEE 802.11
Debian Linux
openEuler
Anolis OS
python3-perf-debuginfo
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
linux (Debian package)
kernel-64k-devel
kernel-debug
kernel-debug-devel
kernel-tools-libs
kernel-tools-libs-devel
kernel-64k
kernel-64k-debug
kernel-64k-debug-devel

Install updates from vendor's website.

python3-perf-debuginfo - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
kernel - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
bpftool - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
bpftool-debuginfo - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
kernel-debuginfo - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
kernel-debugsource - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
kernel-devel - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
kernel-headers - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
kernel-source - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
kernel-tools - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
kernel-tools-debuginfo - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
kernel-tools-devel - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
perf - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
perf-debuginfo - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
python3-perf - addressed in versions 5.10.0-312.0.0.215, 5.10.0-317.0.0.220, 6.6.0-145.0.7.134, 6.6.0-145.0.7.146
linux (Debian package) - addressed in versions 6.1.147-1, 6.12.41-1
kernel-64k-devel - update to 6.6.102-5
bpftool - update to 6.6.102-5
kernel - update to 6.6.102-5
kernel-debug - update to 6.6.102-5
kernel-debug-devel - update to 6.6.102-5
kernel-devel - update to 6.6.102-5
kernel-headers - update to 6.6.102-5
kernel-tools - update to 6.6.102-5
kernel-tools-libs - update to 6.6.102-5
kernel-tools-libs-devel - update to 6.6.102-5
perf - update to 6.6.102-5
python3-perf - update to 6.6.102-5
kernel-64k - update to 6.6.102-5
kernel-64k-debug - update to 6.6.102-5
kernel-64k-debug-devel - update to 6.6.102-5

• https://github.com/vanhoefm/fragattacks-survey-public/blob/main/README.md

• Spoofing attack in IEEE 802.11 implementation
• Debian update for linux
• Debian update for linux
• Anolis OS update for kernel:6.6
• openEuler 24.03 LTS update for kernel
• openEuler 22.03 LTS SP4 update for kernel
• openEuler 24.03 LTS SP1 update for kernel
• openEuler 22.03 LTS SP4 update for kernel