CVE-2025-21979 (GCVE-0-2025-21979)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:47 – Updated: 2026-08-05 11:55
VLAI
Title
wifi: cfg80211: cancel wiphy_work before freeing wiphy
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel wiphy_work before freeing wiphy A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the rdev::wiphy_work is getting queued. If wiphy_free is called before the rdev::wiphy_work had a chance to run, the wiphy memory will be freed, and then when it eventally gets to run it'll use invalid memory. Fix this by canceling the work before freeing the wiphy.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ddb1bfbf4ab5c753954d0cd728253b642934a9f2 , < 8930a3e1568cf534f86c8ed2def817c6d0528fc1 (git)
Affected: 3fcc6d7d5f40dad56dee7bde787b7e23edd4b93c , < 0272d4af7f92997541d8bbf4c51918b93ded6ee2 (git)
Affected: a3ee4dc84c4e9d14cb34dad095fd678127aca5b6 , < 75d262ad3c36d52852d764588fcd887f0fcd9138 (git)
Affected: a3ee4dc84c4e9d14cb34dad095fd678127aca5b6 , < a5158d67bff06cb6fea31be39aeb319fd908ed8e (git)
Affected: a3ee4dc84c4e9d14cb34dad095fd678127aca5b6 , < dea22de162058216a90f2706f0d0b36f0ff309fd (git)
Affected: a3ee4dc84c4e9d14cb34dad095fd678127aca5b6 , < 72d520476a2fab6f3489e8388ab524985d6c4b90 (git)
Affected: 6.1.57 , < 6.1.132 (semver)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.1.132 , ≤ 6.1.* (semver)
Unaffected: 6.6.84 , ≤ 6.6.* (semver)
Unaffected: 6.12.20 , ≤ 6.12.* (semver)
Unaffected: 6.13.8 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21979",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:15:17.684537Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:15:20.536Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:40:19.723Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8930a3e1568cf534f86c8ed2def817c6d0528fc1",
              "status": "affected",
              "version": "ddb1bfbf4ab5c753954d0cd728253b642934a9f2",
              "versionType": "git"
            },
            {
              "lessThan": "0272d4af7f92997541d8bbf4c51918b93ded6ee2",
              "status": "affected",
              "version": "3fcc6d7d5f40dad56dee7bde787b7e23edd4b93c",
              "versionType": "git"
            },
            {
              "lessThan": "75d262ad3c36d52852d764588fcd887f0fcd9138",
              "status": "affected",
              "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6",
              "versionType": "git"
            },
            {
              "lessThan": "a5158d67bff06cb6fea31be39aeb319fd908ed8e",
              "status": "affected",
              "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6",
              "versionType": "git"
            },
            {
              "lessThan": "dea22de162058216a90f2706f0d0b36f0ff309fd",
              "status": "affected",
              "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6",
              "versionType": "git"
            },
            {
              "lessThan": "72d520476a2fab6f3489e8388ab524985d6c4b90",
              "status": "affected",
              "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.132",
              "status": "affected",
              "version": "6.1.57",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "6.1.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.84",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel wiphy_work before freeing wiphy\n\nA wiphy_work can be queued from the moment the wiphy is allocated and\ninitialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the\nrdev::wiphy_work is getting queued.\n\nIf wiphy_free is called before the rdev::wiphy_work had a chance to run,\nthe wiphy memory will be freed, and then when it eventally gets to run\nit\u0027ll use invalid memory.\n\nFix this by canceling the work before freeing the wiphy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The wiphy lifecycle operations that trigger the free (`HWSIM_CMD_NEW_RADIO`/`DEL_RADIO` generic netlink, `RTM_NEWLINK`/`DELLINK` for virt_wifi, netns teardown, module/device removal) are all local syscall/netlink operations. Remote 802.11 frames can keep wiphy_work queued but cannot themselves free the wiphy, so the attacker must have local access.\nAC:L - The attacker drives both halves \u2014 they allocate the wiphy, queue the wiphy_work, and free the wiphy, and can hit deterministic failure paths in `wiphy_new_nm()`/`mac80211_hwsim_new_radio()` or simply loop create/destroy while widening the window with CPU load. Per kernel UAF guidance an attacker-created race is Low.\nPR:L - `hwsim_new_radio_nl`/`hwsim_del_radio_nl` are gated only by `GENL_UNS_ADMIN_PERM`, i.e. `netlink_ns_capable(skb, net-\u003euser_ns, CAP_NET_ADMIN)` on a `.netnsok` family, so any unprivileged user obtains it via `unshare -Urn`; virt_wifi\u0027s rtnetlink create/destroy is namespaced the same way. No real root in the init namespace is needed.\nUI:N - The attacker performs the entire sequence \u2014 allocate wiphy, queue work, free wiphy \u2014 from their own process with no victim participation. No mount, file open, or any other user action is involved.\nS:U - The use-after-free corrupts kernel heap memory and hijacks kernel control flow within the same security authority; no VM, hypervisor, or IOMMU/DMA boundary is crossed.\nC:H - The stale worker reads the work-list head and a `struct wiphy_work *` out of the freed `rdev`, so a heap-spray reclaim of the freed allocation gives the attacker control of those pointers; combined with the `list_del_init()` write primitive this is leverageable into arbitrary kernel memory disclosure.\nI:H - `list_del_init(\u0026wk-\u003eentry)` writes attacker-influenced values through pointers read from freed memory (write-what-where), and `wk-\u003efunc(\u0026rdev-\u003ewiphy, wk)` is an indirect call through a function pointer read from freed memory \u2014 a direct control-flow hijack enabling arbitrary code execution.\nA:H - Even without exploitation the stale `cfg80211_wiphy_work()` takes a mutex and spinlock in freed, already-`mutex_destroy`\u0027d memory and dereferences a garbage list head, producing a KASAN splat, oops, or panic; the attacker can retrigger it in a loop."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:49.695Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8930a3e1568cf534f86c8ed2def817c6d0528fc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0272d4af7f92997541d8bbf4c51918b93ded6ee2"
        },
        {
          "url": "https://git.kernel.org/stable/c/75d262ad3c36d52852d764588fcd887f0fcd9138"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5158d67bff06cb6fea31be39aeb319fd908ed8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/dea22de162058216a90f2706f0d0b36f0ff309fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/72d520476a2fab6f3489e8388ab524985d6c4b90"
        }
      ],
      "title": "wifi: cfg80211: cancel wiphy_work before freeing wiphy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21979",
    "datePublished": "2025-04-01T15:47:08.699Z",
    "dateReserved": "2024-12-29T08:45:45.798Z",
    "dateUpdated": "2026-08-05T11:55:49.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21979",
      "date": "2026-08-05",
      "epss": "0.00192",
      "percentile": "0.09035"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:21:06.000Z",
      "cve": "CVE-2025-21979",
      "id": "msrc_CVE-2025-21979",
      "initial_release_date": "2025-04-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: cfg80211: cancel wiphy_work before freeing wiphy",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21979.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21979\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:29.287\",\"lastModified\":\"2026-06-17T08:44:45.550\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: cancel wiphy_work before freeing wiphy\\n\\nA wiphy_work can be queued from the moment the wiphy is allocated and\\ninitialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the\\nrdev::wiphy_work is getting queued.\\n\\nIf wiphy_free is called before the rdev::wiphy_work had a chance to run,\\nthe wiphy memory will be freed, and then when it eventally gets to run\\nit\u0027ll use invalid memory.\\n\\nFix this by canceling the work before freeing the wiphy.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: cancelar wiphy_work antes de liberar wiphy. Un wiphy_work puede ponerse en cola desde el momento en que se asigna e inicializa el wiphy (es decir, wiphy_new_nm). Cuando se pone en cola un wiphy_work, tambi\u00e9n se pone en cola rdev::wiphy_work. Si se llama a wiphy_free antes de que rdev::wiphy_work se ejecute, se liberar\u00e1 la memoria del wiphy y, cuando finalmente se ejecute, usar\u00e1 memoria no v\u00e1lida. Para solucionar esto, cancele el trabajo antes de liberar el wiphy.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/wireless/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ddb1bfbf4ab5c753954d0cd728253b642934a9f2\",\"lessThan\":\"8930a3e1568cf534f86c8ed2def817c6d0528fc1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3fcc6d7d5f40dad56dee7bde787b7e23edd4b93c\",\"lessThan\":\"0272d4af7f92997541d8bbf4c51918b93ded6ee2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3ee4dc84c4e9d14cb34dad095fd678127aca5b6\",\"lessThan\":\"75d262ad3c36d52852d764588fcd887f0fcd9138\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3ee4dc84c4e9d14cb34dad095fd678127aca5b6\",\"lessThan\":\"a5158d67bff06cb6fea31be39aeb319fd908ed8e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3ee4dc84c4e9d14cb34dad095fd678127aca5b6\",\"lessThan\":\"dea22de162058216a90f2706f0d0b36f0ff309fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3ee4dc84c4e9d14cb34dad095fd678127aca5b6\",\"lessThan\":\"72d520476a2fab6f3489e8388ab524985d6c4b90\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.57\",\"lessThan\":\"6.1.132\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/wireless/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.132\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.84\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.20\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.8\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T17:15:17.684537Z\",\"id\":\"CVE-2025-21979\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.57\",\"versionEndExcluding\":\"6.1.132\",\"matchCriteriaId\":\"AFE31CAB-7E14-4AA4-9EEA-4901C71DFF5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.84\",\"matchCriteriaId\":\"49FD01BB-6E18-4796-A16D-F5E17FAC1E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.20\",\"matchCriteriaId\":\"60E9C5DF-D778-4572-848A-5D6CFFE022CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.8\",\"matchCriteriaId\":\"0A20D4D7-B329-4C68-B662-76062EA7DCF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1759FFB7-531C-41B1-9AE1-FD3D80E0D920\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0272d4af7f92997541d8bbf4c51918b93ded6ee2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72d520476a2fab6f3489e8388ab524985d6c4b90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75d262ad3c36d52852d764588fcd887f0fcd9138\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8930a3e1568cf534f86c8ed2def817c6d0528fc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a5158d67bff06cb6fea31be39aeb319fd908ed8e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dea22de162058216a90f2706f0d0b36f0ff309fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T00:40:43+00:00",
      "cve": "CVE-2025-21979",
      "id": "CVE-2025-21979",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: cfg80211: cancel wiphy_work before freeing wiphy",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21979.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:40:19.723Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21979\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T17:15:17.684537Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T14:38:46.030Z\"}}], \"cna\": {\"title\": \"wifi: cfg80211: cancel wiphy_work before freeing wiphy\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The wiphy lifecycle operations that trigger the free (`HWSIM_CMD_NEW_RADIO`/`DEL_RADIO` generic netlink, `RTM_NEWLINK`/`DELLINK` for virt_wifi, netns teardown, module/device removal) are all local syscall/netlink operations. Remote 802.11 frames can keep wiphy_work queued but cannot themselves free the wiphy, so the attacker must have local access.\\nAC:L - The attacker drives both halves \\u2014 they allocate the wiphy, queue the wiphy_work, and free the wiphy, and can hit deterministic failure paths in `wiphy_new_nm()`/`mac80211_hwsim_new_radio()` or simply loop create/destroy while widening the window with CPU load. Per kernel UAF guidance an attacker-created race is Low.\\nPR:L - `hwsim_new_radio_nl`/`hwsim_del_radio_nl` are gated only by `GENL_UNS_ADMIN_PERM`, i.e. `netlink_ns_capable(skb, net-\u003euser_ns, CAP_NET_ADMIN)` on a `.netnsok` family, so any unprivileged user obtains it via `unshare -Urn`; virt_wifi\u0027s rtnetlink create/destroy is namespaced the same way. No real root in the init namespace is needed.\\nUI:N - The attacker performs the entire sequence \\u2014 allocate wiphy, queue work, free wiphy \\u2014 from their own process with no victim participation. No mount, file open, or any other user action is involved.\\nS:U - The use-after-free corrupts kernel heap memory and hijacks kernel control flow within the same security authority; no VM, hypervisor, or IOMMU/DMA boundary is crossed.\\nC:H - The stale worker reads the work-list head and a `struct wiphy_work *` out of the freed `rdev`, so a heap-spray reclaim of the freed allocation gives the attacker control of those pointers; combined with the `list_del_init()` write primitive this is leverageable into arbitrary kernel memory disclosure.\\nI:H - `list_del_init(\u0026wk-\u003eentry)` writes attacker-influenced values through pointers read from freed memory (write-what-where), and `wk-\u003efunc(\u0026rdev-\u003ewiphy, wk)` is an indirect call through a function pointer read from freed memory \\u2014 a direct control-flow hijack enabling arbitrary code execution.\\nA:H - Even without exploitation the stale `cfg80211_wiphy_work()` takes a mutex and spinlock in freed, already-`mutex_destroy`\u0027d memory and dereferences a garbage list head, producing a KASAN splat, oops, or panic; the attacker can retrigger it in a loop.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ddb1bfbf4ab5c753954d0cd728253b642934a9f2\", \"lessThan\": \"8930a3e1568cf534f86c8ed2def817c6d0528fc1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3fcc6d7d5f40dad56dee7bde787b7e23edd4b93c\", \"lessThan\": \"0272d4af7f92997541d8bbf4c51918b93ded6ee2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a3ee4dc84c4e9d14cb34dad095fd678127aca5b6\", \"lessThan\": \"75d262ad3c36d52852d764588fcd887f0fcd9138\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a3ee4dc84c4e9d14cb34dad095fd678127aca5b6\", \"lessThan\": \"a5158d67bff06cb6fea31be39aeb319fd908ed8e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a3ee4dc84c4e9d14cb34dad095fd678127aca5b6\", \"lessThan\": \"dea22de162058216a90f2706f0d0b36f0ff309fd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a3ee4dc84c4e9d14cb34dad095fd678127aca5b6\", \"lessThan\": \"72d520476a2fab6f3489e8388ab524985d6c4b90\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.1.57\", \"lessThan\": \"6.1.132\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/wireless/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.132\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.20\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/wireless/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8930a3e1568cf534f86c8ed2def817c6d0528fc1\"}, {\"url\": \"https://git.kernel.org/stable/c/0272d4af7f92997541d8bbf4c51918b93ded6ee2\"}, {\"url\": \"https://git.kernel.org/stable/c/75d262ad3c36d52852d764588fcd887f0fcd9138\"}, {\"url\": \"https://git.kernel.org/stable/c/a5158d67bff06cb6fea31be39aeb319fd908ed8e\"}, {\"url\": \"https://git.kernel.org/stable/c/dea22de162058216a90f2706f0d0b36f0ff309fd\"}, {\"url\": \"https://git.kernel.org/stable/c/72d520476a2fab6f3489e8388ab524985d6c4b90\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: cancel wiphy_work before freeing wiphy\\n\\nA wiphy_work can be queued from the moment the wiphy is allocated and\\ninitialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the\\nrdev::wiphy_work is getting queued.\\n\\nIf wiphy_free is called before the rdev::wiphy_work had a chance to run,\\nthe wiphy memory will be freed, and then when it eventally gets to run\\nit\u0027ll use invalid memory.\\n\\nFix this by canceling the work before freeing the wiphy.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.132\", \"versionStartIncluding\": \"6.1.57\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.84\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.20\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.8\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:55:49.695Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21979\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:55:49.695Z\", \"dateReserved\": \"2024-12-29T08:45:45.798Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-04-01T15:47:08.699Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.