CVE-2025-21910

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: regulatory: improve invalid hints checking

Syzbot keeps reporting an issue [1] that occurs when erroneous symbols

sent from userspace get through into user_alpha2[] via

regulatory_hint_user() call. Such invalid regulatory hints should be

rejected.

While a sanity check from commit 47caf685a685 ("cfg80211: regulatory:

reject invalid hints") looks to be enough to deter these very cases,

there is a way to get around it due to 2 reasons.

1) The way isalpha() works, symbols other than latin lower and

upper letters may be used to determine a country/domain.

For instance, greek letters will also be considered upper/lower

letters and for such characters isalpha() will return true as well.

However, ISO-3166-1 alpha2 codes should only hold latin

characters.

2) While processing a user regulatory request, between

reg_process_hint_user() and regulatory_hint_user() there happens to

be a call to queue_regulatory_r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References