CVE-2025-21729: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2025-21729

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_scan completion unset the flag and calls ieee80211_scan_completed() that will free local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and use-after-free. Fix it by moving the check condition to where protected by mutex. KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019 Workqueue: events cfg80211_conn_work [cfg80211] RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001 RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089 RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960 R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0 Call Trace: <TASK> ? show_regs+0x61/0x73 ? __die_body+0x20/0x73 ? die_addr+0x4f/0x7b ? exc_general_protection+0x191/0x1db ? asm_exc_general_protection+0x27/0x30 ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core] ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core] ? do_raw_spin_lock+0x75/0xdb ? __pfx_do_raw_spin_lock+0x10/0x10 rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core] ? _raw_spin_unlock+0xe/0x24 ? __mutex_lock.constprop.0+0x40c/0x471 ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core] ? __mutex_lock_slowpath+0x13/0x1f ? mutex_lock+0xa2/0xdc ? __pfx_mutex_lock+0x10/0x10 rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core] rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core] ieee80211_scan_cancel+0x468/0x4d0 [mac80211] ieee80211_prep_connection+0x858/0x899 [mac80211] ieee80211_mgd_auth+0xbea/0xdde [mac80211] ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211] ? cfg80211_find_elem+0x15/0x29 [cfg80211] ? is_bss+0x1b7/0x1d7 [cfg80211] ieee80211_auth+0x18/0x27 [mac80211] cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211] cfg80211_conn_do_work+0x410/0xb81 [cfg80211] ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211] ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? __kasan_check_write+0x14/0x22 ? mutex_lock+0x8e/0xdc ? __pfx_mutex_lock+0x10/0x10 ? __pfx___radix_tree_lookup+0x10/0x10 cfg80211_conn_work+0x245/0x34d [cfg80211] ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211] ? update_cfs_rq_load_avg+0x3bc/0x3d7 ? sched_clock_noinstr+0x9/0x1a ? sched_clock+0x10/0x24 ? sched_clock_cpu+0x7e/0x42e ? newidle_balance+0x796/0x937 ? __pfx_sched_clock_cpu+0x10/0x10 ? __pfx_newidle_balance+0x10/0x10 ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? _raw_spin_unlock+0xe/0x24 ? raw_spin_rq_unlock+0x47/0x54 ? raw_spin_rq_unlock_irq+0x9/0x1f ? finish_task_switch.isra.0+0x347/0x586 ? __schedule+0x27bf/0x2892 ? mutex_unlock+0x80/0xd0 ? do_raw_spin_lock+0x75/0xdb ? __pfx___schedule+0x10/0x10 process_scheduled_works+0x58c/0x821 worker_thread+0x4c7/0x586 ? __kasan_check_read+0x11/0x1f kthread+0x285/0x294 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x6f ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>

AI Analysis

Technical Summary

CVE-2025-21729 is a high-severity vulnerability in the Linux kernel's wireless driver subsystem, specifically affecting the Realtek rtw89 Wi-Fi driver. The flaw arises from a race condition between the cancel_hw_scan function and the hardware scan completion handler. In the vulnerable code, the rtwdev->scanning flag is not properly protected by a mutex, allowing cancel_hw_scan to proceed past a conditional check while the hardware scan completion concurrently clears the flag and calls ieee80211_scan_completed(), which frees the memory associated with local->hw_scan_req. This sequence leads to a null pointer dereference and use-after-free condition when cancel_hw_scan attempts to access the freed memory. The race condition can cause kernel crashes (null pointer dereference) and potentially arbitrary code execution or privilege escalation due to use-after-free. The vulnerability is identified by Kernel Address Sanitizer (KASAN) reports and involves complex interactions within the cfg80211 and mac80211 subsystems. The CVSS v3.1 score is 7.8 (high), reflecting local attack vector with low complexity, requiring privileges but no user interaction, and impacting confidentiality, integrity, and availability. The issue is fixed by moving the scanning flag check inside a mutex-protected section to prevent concurrent access and memory corruption. No known exploits are reported in the wild as of publication.

Potential Impact

For European organizations, this vulnerability poses significant risks, especially for those relying on Linux-based systems with Realtek rtw89 Wi-Fi hardware, which is common in laptops, desktops, and embedded devices. Exploitation could allow local attackers or malicious processes to cause denial of service via kernel crashes or potentially escalate privileges to gain unauthorized access or control over affected systems. This can compromise sensitive data confidentiality and system integrity, disrupt business operations, and increase the attack surface for further lateral movement within networks. Organizations in sectors such as finance, healthcare, government, and critical infrastructure, which often use Linux servers and workstations, may face heightened risks. The vulnerability's local attack vector means attackers need some level of access, but given the widespread use of Linux and Wi-Fi hardware, the attack surface is broad. Additionally, the kernel-level nature of the flaw means successful exploitation could undermine security controls and detection mechanisms.

Mitigation Recommendations

European organizations should prioritize patching affected Linux kernel versions that include the fix for CVE-2025-21729 as soon as updates are available. Until patches are applied, organizations should restrict local access to trusted users only and monitor for unusual kernel crashes or system instability indicative of exploitation attempts. Implementing strict access controls and endpoint security measures to prevent unauthorized local code execution can reduce risk. Network segmentation and limiting Wi-Fi usage on critical systems can further reduce exposure. For environments where patching is delayed, consider disabling or restricting use of the rtw89 Wi-Fi driver if feasible. Additionally, security teams should enhance monitoring for kernel-level anomalies and review logs for signs of race condition exploitation. Coordinating with hardware vendors and Linux distribution maintainers to ensure timely updates is critical. Finally, educating users about the risks of running untrusted code locally can help mitigate attack vectors.