CVE-2025-21730 is a vulnerability in the Linux kernel specifically related to the rtw89 wireless driver, which supports certain Realtek Wi-Fi chipsets. The flaw arises during the handling of Wake on Wireless LAN (WoWLAN) functionality in the resume flow of the device. When WoWLAN fails, the function rtw89_ops_add_interface() is triggered without first removing the existing interface, causing the mgnt_entry list to be initialized twice. This double initialization bypasses the list_empty() check in rtw89_chanctx_ops_assign_vif(), leading to a second addition of the same list entry via list_add_tail(). This results in list corruption, which triggers a kernel BUG and an invalid opcode exception, causing a kernel panic or system crash. The detailed kernel logs show the failure to disable WoWLAN properly and the subsequent list corruption, culminating in a kernel panic at lib/list_debug.c. The root cause is a missing check to prevent double adding of list entries, which has been addressed in the patch. The vulnerability affects Linux kernel versions containing the rtw89 driver with the affected commit hashes listed. The issue is a memory/list corruption bug triggered by improper handling of WoWLAN failure states, leading to system instability and denial of service. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with the vulnerable rtw89 wireless driver, commonly found in devices using Realtek 8852CE Wi-Fi chipsets. The impact is mainly denial of service due to kernel panics triggered by WoWLAN failure during device resume, which can cause system crashes and potential downtime. This can affect servers, workstations, or embedded devices relying on these wireless components. Critical infrastructure or enterprises using Linux-based systems with these Wi-Fi chipsets could face operational disruptions. While the vulnerability does not directly allow remote code execution or privilege escalation, the resulting kernel panic can be exploited for targeted denial of service attacks, especially in environments where WoWLAN is enabled or devices frequently enter suspend/resume cycles. The lack of known exploits reduces immediate risk, but the vulnerability’s presence in widely used Linux kernels means it could be leveraged in the future. European organizations with a high dependency on Linux wireless networking, such as telecommunications, cloud providers, or enterprises with remote workforces, may experience service interruptions or degraded network availability.

To mitigate this vulnerability, organizations should: 1) Apply the official Linux kernel patches that fix the double initialization check in the rtw89 driver as soon as they become available from trusted Linux distributors or kernel maintainers. 2) Temporarily disable WoWLAN functionality on affected devices if patching is not immediately possible, to prevent triggering the vulnerable code path during resume. 3) Monitor kernel logs for signs of WoWLAN failure or list corruption errors to detect potential exploitation attempts or system instability. 4) Audit and inventory Linux systems to identify those running affected kernel versions with the rtw89 driver and Realtek 8852CE chipsets. 5) For critical systems, consider isolating or limiting network access to reduce exposure to potential denial of service attacks exploiting this flaw. 6) Engage with hardware vendors for firmware updates or driver replacements that may further harden WoWLAN handling. 7) Implement robust system monitoring and automated reboot mechanisms to recover quickly from kernel panics caused by this issue.