CVE-2025-71224: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71224 is a vulnerability in the Linux kernel's mac80211 subsystem affecting the OCB (Outside the Context of a BSS) wireless interface mode. The flaw occurs because ieee80211_ocb_rx_no_sta() assumes a valid channel context is present, which is only established after a JOIN_OCB operation; if RX processing occurs before JOIN_OCB, the interface is not operational and the assumption is invalid, leading to kernel warnings. It affects the Linux kernel across multiple stable branches and was published on February 14, 2026. Feedly estimates this as a Medium severity vulnerability, with an EPSS score of 0.024% (Feedly).

The root cause is a missing state check in the ieee80211_ocb_rx_no_sta() function within the Linux kernel's net/mac80211/ocb.c. When a wireless interface operating in OCB mode receives packets before the JOIN_OCB command is executed, the function attempts to access a channel context that has not yet been allocated, resulting in kernel warnings or potential null pointer dereferences (CWE-476). The fix adds a guard to skip RX peer handling when the OCB interface has not yet joined, preventing the invalid access. The vulnerability is reachable locally by a user or process that can trigger wireless RX on an unjoined OCB interface (Feedly).

Exploitation of this vulnerability can cause kernel warnings and potentially a denial-of-service condition on systems using OCB-mode wireless interfaces (e.g., for V2X/DSRC vehicular communications). The primary impact is on availability, as the invalid channel context access can destabilize the kernel's wireless subsystem. Confidentiality and integrity impacts are considered low, as the flaw does not directly expose sensitive data or allow unauthorized writes (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-71224. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term (Feedly).

The Linux kernel maintainers have addressed this vulnerability through patches applied to multiple stable branches, with commits available at the kernel.org stable repository (e.g., commits 8fd1c63e, 536447521b, b04c75366a, e0bd226804, fcc768760d). Downstream distributions including Debian, Ubuntu, SUSE, Oracle Linux, and Red Hat have issued updated kernel packages incorporating this fix (Debian LTS, Ubuntu USN-8278-1, Ubuntu USN-8289-1, Ubuntu USN-8296-1). Users should update to the latest patched kernel version provided by their distribution. No configuration-based workaround is documented; upgrading is the recommended remediation.