In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: regulatory: improve invalid hints checking
Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into useralpha2[] via regulatoryhint_user() call. Such invalid regulatory hints should be rejected.
While a sanity check from commit 47caf685a685 ("cfg80211: regulatory: reject invalid hints") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons.
1) The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a country/domain. For instance, greek letters will also be considered upper/lower letters and for such characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin characters.
2) While processing a user regulatory request, between regprocesshintuser() and regulatoryhintuser() there happens to be a call to queueregulatory_request() which modifies letters in request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters from the second part of _ctype[].
Syzbot triggers a warning in isuserregdom_saved() by first sending over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing isalpha() check.
Prevent this by enhancing isanalpha2() to ensure that incoming symbols are latin letters and nothing else.
[1] Syzbot report: ------------[ cut here ]------------ Unexpected user alpha2: A� WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 isuserregdomsaved net/wireless/reg.c:440 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restorealpha2 net/wireless/reg.c:3424 [inline] WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restoreregulatorysettings+0x3c0/0x1e50 net/wireless/reg.c:3516 Modules linked in: CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: eventspowerefficient crdatimeoutwork RIP: 0010:isuserregdomsaved net/wireless/reg.c:440 [inline] RIP: 0010:restorealpha2 net/wireless/reg.c:3424 [inline] RIP: 0010:restoreregulatorysettings+0x3c0/0x1e50 net/wireless/reg.c:3516 ... Call Trace: <TASK> crdatimeoutwork+0x27/0x50 net/wireless/reg.c:542 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xa65/0x1850 kernel/workqueue.c:3310 workerthread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 retfromfork+0x4d/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
[
    {
        "id": "CVE-2025-21910-0c0e59d6",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/wireless/reg.c"
        },
        "digest": {
            "line_hashes": [
                "247413871905003153036126012764389462415",
                "1355387254779867979395478862611656190",
                "334632091597019623137013102550817956060",
                "251041967969317077596366048235499510824"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da3f599517ef2ea851208df3229d07728d238dc5"
    },
    {
        "id": "CVE-2025-21910-2067e86f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/wireless/reg.c",
            "function": "is_an_alpha2"
        },
        "digest": {
            "function_hash": "158902897334904233148433932979220627545",
            "length": 141.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4112cb477c727a65787a4065a75ca593bb5b2f4"
    },
    {
        "id": "CVE-2025-21910-2238852c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/wireless/reg.c",
            "function": "is_an_alpha2"
        },
        "digest": {
            "function_hash": "158902897334904233148433932979220627545",
            "length": 141.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da3f599517ef2ea851208df3229d07728d238dc5"
    },
    {
        "id": "CVE-2025-21910-4539e729",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/wireless/reg.c"
        },
        "digest": {
            "line_hashes": [
                "247413871905003153036126012764389462415",
                "1355387254779867979395478862611656190",
                "334632091597019623137013102550817956060",
                "251041967969317077596366048235499510824"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be7c5f00aa7f1344293e4d48d0e12be83a2f223d"
    },
    {
        "id": "CVE-2025-21910-470a417a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/wireless/reg.c",
            "function": "is_an_alpha2"
        },
        "digest": {
            "function_hash": "158902897334904233148433932979220627545",
            "length": 141.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be7c5f00aa7f1344293e4d48d0e12be83a2f223d"
    },
    {
        "id": "CVE-2025-21910-5dff7489",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/wireless/reg.c"
        },
        "digest": {
            "line_hashes": [
                "247413871905003153036126012764389462415",
                "1355387254779867979395478862611656190",
                "334632091597019623137013102550817956060",
                "251041967969317077596366048235499510824"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62b1a9bbfebba4b4c2bb6c1ede9ef7ecee7a9ff6"
    },
    {
        "id": "CVE-2025-21910-6ccd450f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/wireless/reg.c"
        },
        "digest": {
            "line_hashes": [
                "247413871905003153036126012764389462415",
                "1355387254779867979395478862611656190",
                "334632091597019623137013102550817956060",
                "251041967969317077596366048235499510824"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35ef07112b61b06eb30683a6563c9f6378c02476"
    },
    {
        "id": "CVE-2025-21910-8b9c22c1",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/wireless/reg.c"
        },
        "digest": {
            "line_hashes": [
                "247413871905003153036126012764389462415",
                "1355387254779867979395478862611656190",
                "334632091597019623137013102550817956060",
                "251041967969317077596366048235499510824"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4112cb477c727a65787a4065a75ca593bb5b2f4"
    },
    {
        "id": "CVE-2025-21910-9112b441",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/wireless/reg.c",
            "function": "is_an_alpha2"
        },
        "digest": {
            "function_hash": "158902897334904233148433932979220627545",
            "length": 141.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59b348be7597c4a9903cb003c69e37df20c04a30"
    },
    {
        "id": "CVE-2025-21910-b2056b0b",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/wireless/reg.c",
            "function": "is_an_alpha2"
        },
        "digest": {
            "function_hash": "158902897334904233148433932979220627545",
            "length": 141.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35ef07112b61b06eb30683a6563c9f6378c02476"
    },
    {
        "id": "CVE-2025-21910-b3110440",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/wireless/reg.c",
            "function": "is_an_alpha2"
        },
        "digest": {
            "function_hash": "158902897334904233148433932979220627545",
            "length": 141.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a5e3b23054cee3b92683d1467e3fa83921f5622"
    },
    {
        "id": "CVE-2025-21910-d7084214",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/wireless/reg.c",
            "function": "is_an_alpha2"
        },
        "digest": {
            "function_hash": "158902897334904233148433932979220627545",
            "length": 141.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17aa34c84867f6cd181a5743e1c647e7766962a6"
    },
    {
        "id": "CVE-2025-21910-e4845c17",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/wireless/reg.c",
            "function": "is_an_alpha2"
        },
        "digest": {
            "function_hash": "158902897334904233148433932979220627545",
            "length": 141.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62b1a9bbfebba4b4c2bb6c1ede9ef7ecee7a9ff6"
    },
    {
        "id": "CVE-2025-21910-e48ac553",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/wireless/reg.c"
        },
        "digest": {
            "line_hashes": [
                "247413871905003153036126012764389462415",
                "1355387254779867979395478862611656190",
                "334632091597019623137013102550817956060",
                "251041967969317077596366048235499510824"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59b348be7597c4a9903cb003c69e37df20c04a30"
    },
    {
        "id": "CVE-2025-21910-e8ec4715",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/wireless/reg.c"
        },
        "digest": {
            "line_hashes": [
                "247413871905003153036126012764389462415",
                "1355387254779867979395478862611656190",
                "334632091597019623137013102550817956060",
                "251041967969317077596366048235499510824"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a5e3b23054cee3b92683d1467e3fa83921f5622"
    },
    {
        "id": "CVE-2025-21910-e932ffc9",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/wireless/reg.c"
        },
        "digest": {
            "line_hashes": [
                "247413871905003153036126012764389462415",
                "1355387254779867979395478862611656190",
                "334632091597019623137013102550817956060",
                "251041967969317077596366048235499510824"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17aa34c84867f6cd181a5743e1c647e7766962a6"
    }
]