CVE-2025-27558: Linux Kernel Wi-Fi Mesh Packet Injection (USN-8661-2) — Detection, Patching, and Hardening Guide

Canonical has published USN-8661-2, a follow-on kernel security update for the Low Latency kernel flavor on supported Ubuntu releases. The update resolves CVE-2025-27558 — a Wi-Fi frame aggregation handling flaw in mesh networking that stems from an incorrect fix for the 2020 FragAttacks research (CVE-2020-24588) — along with a broad sweep of vulnerabilities across fifteen kernel subsystems including Netfilter, Open vSwitch, Ext4, NVMe, TCP, MPTCP, SCTP, and IPv4/IPv6 networking.

For defenders, two things matter here. First, CVE-2025-27558 is a reminder that Wi-Fi protocol remediation is never "done" — a patched bug can be re-broken by an incomplete fix, and organizations running mesh or ad-hoc wireless topologies on Linux (industrial sensors, warehouse robotics, IoT gateways, drone controllers, field deployments) remain exposed to physically proximate packet injection until this kernel lands. Second, the breadth of the subsystem list means this single update closes privilege escalation and memory corruption surfaces that attackers routinely chain after initial access. Treat this as a priority kernel maintenance event, not a routine one.

What Happened

Security researchers Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef (Vanhoef being the researcher behind the original FragAttacks and KRACK disclosures) discovered that the Linux kernel's Wi-Fi implementation — specifically the mac80211 subsystem's handling of A-MSDU (Aggregated MAC Service Data Unit) frames in mesh networks — failed to properly process aggregated frames. The root cause is an incorrect or incomplete fix applied for CVE-2020-24588, which addressed the aggregation flag not being authenticated in the 802.11 header. The 2020 remediation covered managed/infrastructure mode paths but left the mesh path insufficiently protected, allowing the same class of attack to survive on mesh interfaces.

A physically proximate attacker — one within radio range of a vulnerable mesh node — can exploit this flaw to inject arbitrary packets into the network. In practical terms, this means an attacker positioned near a warehouse, campus, industrial site, or event venue using Linux-based 802.11s mesh backhauls could insert crafted traffic past the link-layer trust boundary, potentially enabling man-in-the-middle positioning, session hijacking of higher-layer protocols, or delivery of malicious payloads to mesh members.

In addition to CVE-2025-27558, USN-8661-2 corrects flaws in: x86 architecture, InfiniBand drivers, network drivers, NVMe drivers, Ext4, SMB (ksmbd/CIFS), IPv4, traffic control (tc), TCP, locking primitives, IPv6, Multipath TCP, Netfilter, Open vSwitch, and SCTP. Canonical rates these issues as ones that "an attacker could possibly use to compromise the system" — language Canonical typically reserves for memory corruption and privilege escalation class bugs.

Technical Analysis

Affected Products and Platforms

• Ubuntu Low Latency kernel builds on supported LTS releases (this notice is the -2 revision for the lowlatency flavor; the corresponding generic kernel update was issued under the related USN)
• Any Ubuntu system with a wireless interface operating in 802.11s mesh mode (iw dev shows type mesh) is in the CVE-2025-27558 attack surface
• Infrastructure-only Wi-Fi clients and APs are not exposed to the mesh-specific flaw but remain exposed to the other corrected subsystem bugs
• Systems with Netfilter/Open vSwitch in the data path (hypervisors, SDN controllers, Kubernetes nodes using OVS/OVN), NVMe storage, SMB file serving, or SCTP/MPTCP endpoints all carry risk from the companion fixes

CVE and Severity

• CVE-2025-27558 — Improper handling of aggregated frames (A-MSDU) in mesh networks due to incorrect CVE-2020-24588 fix. Impact: packet injection. Exploitation requires physical/radio proximity. Canonical assesses this as a medium-priority issue; no public CVSS vector was assigned in the notice at time of writing.
• The remaining subsystem fixes are covered under the umbrella USN with individual CVEs enumerated in the primary USN-8661-1 notice and the Ubuntu CVE tracker.

How the Attack Works (Defender's View)

1. Reconnaissance: The attacker identifies a mesh network within radio range (passive beacon/probe analysis reveals 802.11s mesh BSSIDs).
2. Positioning: The attacker associates to or spoofs presence within the mesh — radio proximity is the only hard requirement; no credentials, no user interaction, no prior network access.
3. Exploitation: The attacker crafts an aggregated frame whose A-MSDU subframes are misinterpreted by the kernel's mesh receive path. Because the aggregation flag handling is not correctly enforced on the mesh path, a crafted subframe can be interpreted as a legitimate interior packet — classic frame confusion.
4. Injection: The inner forged packet is delivered up the stack as if it originated from inside the protected wireless domain, bypassing the integrity assumptions of WPA2/WPA3 link-layer encryption for the injected content.

This is the same structural weakness class as FragAttacks: design/implementation flaws in frame aggregation logic, exploitable without breaking encryption itself.

Exploitation Status

At publication, there is no confirmed in-the-wild exploitation of CVE-2025-27558 and it is not listed in CISA KEV. Given the research lineage (Vanhoef's team publishes working PoCs, historically via tools like the FragAttacks test suite), defenders should assume functional proof-of-concept code exists or will exist shortly. Proximity-limited wireless bugs tend to be weaponized in targeted scenarios — physical penetration engagements, red team operations, and industrial espionage — rather than mass campaigns. If your threat model includes adversaries who can get within a few hundred meters of your facilities with an SDR or a laptop, this is a live risk.

Detection & Response

Direct detection of A-MSDU frame confusion at the endpoint is difficult — the malformed frame is consumed by the kernel driver and rarely logged. Realistic defensive telemetry focuses on three observable layers: (1) identifying unpatched kernels and mesh interfaces in the fleet, (2) watching for post-injection anomalies (unexpected ARP/IP traffic on mesh segments, unexpected services reachable over wireless interfaces), and (3) hunting for follow-on kernel exploitation behavior (unexpected module loads, kernel taint events, suspicious netlink/tc/netfilter changes) given the other patched subsystems.

---
title: Linux Wireless Interface Operating in Mesh Mode Identified
description: Identifies hosts with 802.11s mesh interfaces, which constitute the attack surface for CVE-2025-27558 (Linux kernel mesh A-MSDU packet injection). Use for asset inventory and patch prioritization, not as an attack alert.
references:
  - https://ubuntu.com/security/notices/USN-8661-2
  - https://ubuntu.com/security/CVE-2025-27558
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.initial_access
logsource:
  category: process_creation
  product: linux
detection:
  selection_iw:
    Image|endswith: '/iw'
    CommandLine|contains:
      - 'mesh'
      - 'mesh join'
      - 'interface add'
  selection_iwconfig:
    Image|endswith:
      - '/iwconfig'
      - '/iwlist'
  condition: 1 of selection_*
falsepositives:
  - Legitimate mesh network administration by network engineering teams
level: informational
---
title: Unexpected Kernel Module Load on Wireless-Enabled Linux Host
description: Detects kernel module loading activity associated with wireless/mac80211 components or unexpected out-of-tree modules, a potential indicator of kernel-level exploitation attempts or post-compromise rootkit staging following network injection such as CVE-2025-27558.
references:
  - https://ubuntu.com/security/notices/USN-8661-2
  - https://attack.mitre.org/techniques/T1547/006/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.persistence
  - attack.t1547.006
  - attack.defense_evasion
logsource:
  category: process_creation
  product: linux
detection:
  selection_tools:
    Image|endswith:
      - '/insmod'
      - '/modprobe'
  selection_suspicious_args:
    CommandLine|contains:
      - 'mac80211'
      - 'cfg80211'
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: selection_tools and selection_suspicious_args
falsepositives:
  - Driver updates, DKMS rebuilds after kernel upgrades, legitimate wireless troubleshooting
level: medium
---
title: Suspicious Netfilter or Traffic Control Modification by Non-System Process
description: Detects nftables/iptables/tc rule manipulation from unusual parent contexts. USN-8661-2 patches Netfilter, Open vSwitch, and traffic control flaws; post-exploitation tampering with packet filtering is a common follow-on behavior after achieving code execution or injected network access.
references:
  - https://ubuntu.com/security/notices/USN-8661-2
  - https://attack.mitre.org/techniques/T1562/004/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1562.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/nft'
      - '/iptables'
      - '/ip6tables'
      - '/tc'
      - '/ovs-vsctl'
      - '/ovs-ofctl'
  selection_flush_or_disable:
    CommandLine|contains:
      - 'flush'
      - ' -F'
      - 'delete table'
      - 'add rule'
      - 'flow add'
  filter_legit_parents:
    ParentImage|endswith:
      - '/sshd'
      - '/systemd'
      - '/cloud-init'
      - '/ansible-playbook'
      - '/salt-minion'
      - '/chef-client'
      - '/puppet'
  condition: selection_img and selection_flush_or_disable and not filter_legit_parents
falsepositives:
  - Container orchestration (kube-proxy, CNI plugins) modifying rules; add environment-specific parent allowlists
level: high

The following hunt query assumes Linux syslog/audit data is ingested into Microsoft Sentinel via the Syslog or CEF connector, or Defender for Endpoint on Linux:

// Identify unpatched lowlatency kernels and mesh-interface activity in the fleet
// Tune the kernel version threshold to the fixed build for your Ubuntu release
union isfuzzy=true
    (Syslog
    | where SyslogMessage has_any ("mesh", "mac80211", "cfg80211")
    | where SyslogMessage has_any ("kernel:", "iw:", "wpa_supplicant")
    | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage),
    (DeviceProcessEvents
    | where FileName in~ ("iw", "iwconfig", "modprobe", "insmod", "nft", "tc", "ovs-ofctl")
    | where ProcessCommandLine has_any ("mesh", "mac80211", "flush", "add rule", "flow add")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count()
    by Computer, FileName, ProcessCommandLine
| order by EventCount desc

For endpoint fleet sweeps, Velociraptor can rapidly inventory which hosts run a vulnerable kernel or operate mesh interfaces:

-- Inventory kernel versions and wireless mesh interfaces to scope USN-8661-2 exposure
SELECT
    Fqdn,
    Uname.Release AS KernelVersion,
    (SELECT Name FROM pslist() WHERE Name =~ 'wpa_supplicant|NetworkManager' LIMIT 5) AS WirelessProcesses
FROM info()
WHERE Uname.Release =~ 'lowlatency'
   OR Uname.Release =~ '^5\.|^6\.[0-8]'

-- Enumerate mesh interfaces via sysfs
SELECT
    FullPath,
    read_file(filename=FullPath) AS InterfaceType
FROM glob(globs='/sys/class/net/*/type')

Use the VQL output to build your patch priority list: any host reporting a lowlatency kernel build older than the fixed package version, or any host exposing a mesh-capable interface, goes to the front of the queue.

Remediation

1. Apply USN-8661-2 immediately on lowlatency kernel systems. Fetch the exact fixed package version for your Ubuntu release from the official notice at https://ubuntu.com/security/notices/USN-8661-2 and verify against apt list --installed | grep linux-image. The generic-kernel counterpart is covered under USN-8661-1; patch both flavors if present.

#!/bin/bash
# USN-8661-2 remediation and verification for Ubuntu systems
# Run with sudo. Test in staging before fleet rollout.

set -euo pipefail

# Step 1: Update package metadata and upgrade kernel packages
apt-get update
apt-get install --only-upgrade -y linux-image-lowlatency linux-headers-lowlatency || \
  apt-get dist-upgrade -y

# Step 2: Record running vs. installed kernel — reboot is REQUIRED for kernel updates
RUNNING=$(uname -r)
INSTALLED=$(dpkg-query -W -f='${Version}\n' linux-image-lowlatency 2>/dev/null || echo "n/a")
echo "Running kernel: ${RUNNING}"
echo "Installed lowlatency package: ${INSTALLED}"
echo "ACTION REQUIRED: Reboot to activate the patched kernel."

# Step 3: Scope mesh exposure — any interface in mesh mode is the CVE-2025-27558 attack surface
echo "--- Mesh interface inventory ---"
for iface in $(ls /sys/class/net/); do
  MODE=$(iw dev "$iface" info 2>/dev/null | awk '/type/{print $2}' || true)
  if [[ "${MODE}" == "mesh" ]]; then
    echo "WARNING: ${iface} operating in mesh mode — prioritize this host"
  fi
done

# Step 4: Post-reboot verification — confirm no module/ABI mismatch and kernel taint is clean
# Run after reboot:
#   uname -r                       # must match the patched build
#   cat /proc/sys/kernel/tainted   # must be 0
#   dmesg | grep -iE 'mac80211|cfg80211' | head

# Step 5: Compensating control where patching is delayed — disable unused wireless interfaces
# for iface in wlan0 wlan1; do ip link set "$iface" down; done

2. Reboot. Kernel updates do not take effect until restart. Track reboot debt explicitly — an installed-but-not-running patched kernel is an unpatched kernel for every detection and audit purpose. Automate verification with a post-reboot check comparing uname -r against the expected fixed build.

3. Where immediate patching is impossible, reduce the wireless attack surface: take unused Wi-Fi interfaces down (ip link set <iface> down), disable mesh functionality on hosts that do not require it, and enforce physical security controls around facilities where mesh networks operate (the exploit requires radio proximity — perimeter and RF monitoring directly raise attacker cost).

4. Segment mesh networks. Treat 802.11s segments as untrusted transit. Enforce upper-layer protections (mutual TLS, IPsec, WireGuard) so that injected link-layer packets cannot ride trusted application channels. This defense-in-depth posture mitigates the entire FragAttacks flaw class, not just this CVE.

5. Patch the companion subsystems deliberately. If you run Open vSwitch (SDN/Kubernetes nodes), ksmbd (SMB serving), or expose SCTP/MPTCP endpoints, validate those services post-update — the same USN fixes their respective kernel paths.

6. Track via your vuln management program. Register CVE-2025-27558 and the USN-8661 series in your scanner's kernel audit policies, set a remediation SLA consistent with your exposure (internet-facing or wireless-accessible assets: days, not weeks), and confirm coverage in the Ubuntu Security Notices feed at https://ubuntu.com/security/notices.

Executive Takeaways for Leadership

• A "fixed" 2020 vulnerability is back in mesh form. Incomplete remediation is a systemic pattern in Wi-Fi protocol security; assume protocol stacks carry residual fragility and layer compensating controls (encryption above L2, segmentation, RF physical security).
• Proximity is not a comfort. Wireless injection bugs translate into real-world exposure wherever attackers can physically approach — logistics yards, plants, retail, campuses. If your facilities are publicly accessible, your wireless Linux estate is in scope.
• Kernel patch latency is a measurable risk metric. Track days-to-patch and reboot completion for kernel USNs as a first-class KPI; the companion fixes in this update cover exactly the subsystems (Netfilter, OVS, NVMe, Ext4) that post-exploitation privilege escalation chains abuse.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub