CVE-2025-22119 is a vulnerability identified in the Linux kernel's wireless subsystem, specifically within the cfg80211 component responsible for wireless device configuration. The issue arises from improper initialization order of the wiphy_work structure and rfkill allocation during the wireless device release process. When rfkill allocation fails, the kernel proceeds to release the wireless device, triggering the cfg80211_dev_free function. However, due to the uninitialized wiphy_work_lock, this function accesses uninitialized data, leading to potential use-after-free or race conditions. The root cause is that wiphy_work is initialized after rfkill allocation, but if rfkill allocation fails, the release process accesses wiphy_work before it is properly initialized. The fix involves moving the initialization of wiphy_work to occur before rfkill initialization, ensuring that the release process does not access uninitialized data. The vulnerability was discovered and reported by syzbort, with kernel stack traces indicating lockdep warnings and improper locking annotations. This flaw could lead to kernel crashes or undefined behavior due to improper locking and memory access in the wireless subsystem. Although no known exploits are reported in the wild, the vulnerability affects multiple Linux kernel versions, including recent development releases, and impacts systems using wireless networking features. The vulnerability does not require user interaction but involves kernel-level operations, making exploitation more complex but potentially severe if triggered by crafted wireless device operations or malformed kernel requests.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions with wireless networking enabled. Potential impacts include kernel crashes leading to denial of service, instability of wireless network interfaces, and possible escalation of privileges if an attacker can exploit the race condition or use-after-free to execute arbitrary code in kernel context. Critical infrastructure, telecommunications providers, and enterprises relying on Linux-based wireless access points or embedded devices could face service disruptions. Given the widespread use of Linux in servers, IoT devices, and network equipment across Europe, the vulnerability could affect a broad range of sectors including finance, healthcare, manufacturing, and public services. The lack of known exploits reduces immediate risk, but the complexity of the flaw and its kernel-level nature mean that sophisticated threat actors could develop exploits targeting wireless subsystems. This could lead to targeted attacks on wireless infrastructure or compromise of devices used in sensitive environments.

European organizations should prioritize updating Linux kernels to versions where this vulnerability is patched, ensuring that the initialization order of wiphy_work and rfkill allocation is corrected. For systems where immediate patching is not feasible, disabling wireless networking or rfkill functionality temporarily can reduce exposure. Network administrators should monitor kernel logs for lockdep warnings or unusual wireless device errors that might indicate exploitation attempts. Employing kernel lockdown features and restricting access to kernel interfaces related to wireless device management can limit attack surface. Additionally, organizations should audit embedded Linux devices and IoT equipment for affected kernel versions and coordinate with vendors for firmware updates. Implementing strict network segmentation for wireless infrastructure and using intrusion detection systems capable of monitoring kernel-level anomalies can provide early warning of exploitation attempts. Finally, maintaining up-to-date backups and incident response plans will help mitigate impact if exploitation occurs.