CVE-2025-71127: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71127 is a security flaw in the Linux kernel's mac80211 WiFi subsystem that allows unicast Beacon frames to bypass beacon protection mechanisms due to improper BIGTK (Beacon Integrity Group Temporal Key) validation logic. According to IEEE 802.11-2020 standard (section 11.1.3.1), Beacon frames must be sent to the broadcast address; however, the kernel's mac80211 implementation fails to correctly filter unicast Beacon frames when the Protected Frame bit in the Frame Control field is set to 1. The vulnerability affects Linux kernel versions 5.7 through 6.19-rc8, including 5.7.1–5.10.247, 5.11–5.15.197, 5.16–6.1.159, 6.2–6.6.119, 6.7–6.12.64, and 6.13–6.18.3. It was published on January 14, 2026, with patches released on January 19, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patches).

The root cause is an improper input validation flaw (classified as NVD-CWE-noinfo / insufficient information) in the mac80211 layer's Beacon frame processing logic. When a unicast Beacon frame arrives with the Protected Frame bit set to 1 in the Frame Control field, the code path that checks for configured BIGTKs does not function correctly — it fails to reject the frame as it should. As a result, if the underlying WiFi driver does not independently drop such frames, mac80211 accepts them as valid Beacon frames even though they are not properly protected, effectively bypassing beacon protection. The fix implements a generic check that discards all received Beacon frames where the Address 1 (A1) field is set to a unicast (non-broadcast) address, covering both the unprotected and protected frame scenarios (Feedly, kernel.org patches).

Successful exploitation allows a local attacker with low privileges to send crafted unicast Beacon frames — such as Channel Switch Announcements (CSA) — to associated WiFi stations, potentially forcing them to switch to attacker-controlled channels or disrupting normal network operations. The primary impact is availability (denial of service through forced channel switching or network disruption) with no direct confidentiality or integrity impact on data. Environments relying on beacon protection (BIGTK) for network security are particularly at risk, as the protection mechanism can be silently bypassed (Feedly).

Update the Linux kernel to a patched version: 5.10.248 or later (5.10.x series), 5.15.198 or later (5.15.x series), 6.1.160 or later (6.1.x series), 6.6.120 or later (6.6.x series), 6.12.65 or later (6.12.x series), or 6.18.4 or later (6.13+ series). Microsoft's Azure Linux 3 (azl3_kernel_6.6.119.3-3) is also affected and should be updated to the latest patched kernel. Patches are available via kernel.org stable trees and have been incorporated into downstream distributions including Ubuntu (USN-8277-1, USN-8277-2, USN-8310-1, USN-8374-1) and Oracle Linux. No configuration-based workaround is available; upgrading is the only remediation (Feedly, kernel.org patches, Ubuntu USN-8277-1).