---
id: CVE-2025-38509
title: 'wifi: mac80211: reject VHT opmode for unsupported channel widths'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: reject VHT opmode for unsupported channel widths

  VHT operating mode notifications are not defined for channel widths
  below 20 MHz. In particular, 5 MHz…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 751e7489c1d74b94ffffbed619d8fd724eeff4ee <
    18eca59a04500b68a90e0c5c873f97c9d1ea2bfa
  - >-
    Linux >= 751e7489c1d74b94ffffbed619d8fd724eeff4ee <
    58fcb1b4287ce38850402bb2bb16d09bf77b91d9
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:57:34.431263Z'
published: '2025-08-16'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:40.218Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38509'
references:
  - url: 'https://git.kernel.org/stable/c/18eca59a04500b68a90e0c5c873f97c9d1ea2bfa'
  - url: 'https://git.kernel.org/stable/c/58fcb1b4287ce38850402bb2bb16d09bf77b91d9'
tags:
  - cve.org
epss: 0.00139
epssPercentile: 0.03332
ingestedAt: '2026-11-05T22:38:31.977Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: reject VHT opmode for unsupported channel widths

VHT operating mode notifications are not defined for channel widths
below 20 MHz. In particular, 5 MHz and 10 MHz are not valid under the
VHT specification and must be rejected.

Without this check, malformed notifications using these widths may
reach ieee80211_chan_width_to_rx_bw(), leading to a WARN_ON due to
invalid input. This issue was reported by syzbot.

Reject these unsupported widths early in sta_link_apply_parameters()
when opmode_notif is used. The accepted set includes 20, 40, 80, 160,
and 80+80 MHz, which are valid for VHT. While 320 MHz is not defined
for VHT, it is allowed to avoid rejecting HE or EHT clients that may
still send a VHT opmode notification.

## Affected

- `Linux >= 751e7489c1d74b94ffffbed619d8fd724eeff4ee < 18eca59a04500b68a90e0c5c873f97c9d1ea2bfa`
- `Linux >= 751e7489c1d74b94ffffbed619d8fd724eeff4ee < 58fcb1b4287ce38850402bb2bb16d09bf77b91d9`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.