CVE-2025-38505: 
Linux Debian vulnerability analysis and mitigation

A vulnerability in the Linux kernel's mwifiex driver was discovered and reported on August 16, 2025. The issue affects systems operating in concurrent STA/AP mode with host MLME enabled, where the firmware incorrectly sends disassociation frames to the STA interface when clients disconnect from the AP interface (NVD Database).

The vulnerability occurs when the firmware incorrectly sends disassociation frames to the STA interface during client disconnections from the AP interface. This triggers kernel warnings as the STA interface processes disconnect events that don't apply to it. The issue manifests in the cfg80211processdisassoc function, causing WARN_ON() triggers in the MLME layer (NVD Database).

The vulnerability results in kernel warnings and potential system instability when operating in concurrent STA/AP mode. The issue specifically affects the mwifiex driver's handling of disassociation frames, which could lead to system resource consumption and degraded performance (NVD Database).

A fix has been implemented that adds validation in the STA receive path to verify that disassoc/deauth frames originate from the connected AP. Frames that fail this check are discarded early, preventing them from reaching the MLME layer. The filtering logic is similar to that used in the ieee80211rxmgmt_disassoc() function in mac80211 (NVD Database).