CVE-2025-21979

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21979", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.798Z", "datePublished": "2025-04-01T15:47:08.699Z", "dateUpdated": "2026-08-05T11:55:49.695Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:49.695Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel wiphy_work before freeing wiphy\n\nA wiphy_work can be queued from the moment the wiphy is allocated and\ninitialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the\nrdev::wiphy_work is getting queued.\n\nIf wiphy_free is called before the rdev::wiphy_work had a chance to run,\nthe wiphy memory will be freed, and then when it eventally gets to run\nit'll use invalid memory.\n\nFix this by canceling the work before freeing the wiphy."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The wiphy lifecycle operations that trigger the free (`HWSIM_CMD_NEW_RADIO`/`DEL_RADIO` generic netlink, `RTM_NEWLINK`/`DELLINK` for virt_wifi, netns teardown, module/device removal) are all local syscall/netlink operations. Remote 802.11 frames can keep wiphy_work queued but cannot themselves free the wiphy, so the attacker must have local access.\nAC:L - The attacker drives both halves \u2014 they allocate the wiphy, queue the wiphy_work, and free the wiphy, and can hit deterministic failure paths in `wiphy_new_nm()`/`mac80211_hwsim_new_radio()` or simply loop create/destroy while widening the window with CPU load. Per kernel UAF guidance an attacker-created race is Low.\nPR:L - `hwsim_new_radio_nl`/`hwsim_del_radio_nl` are gated only by `GENL_UNS_ADMIN_PERM`, i.e. `netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)` on a `.netnsok` family, so any unprivileged user obtains it via `unshare -Urn`; virt_wifi's rtnetlink create/destroy is namespaced the same way. No real root in the init namespace is needed.\nUI:N - The attacker performs the entire sequence \u2014 allocate wiphy, queue work, free wiphy \u2014 from their own process with no victim participation. No mount, file open, or any other user action is involved.\nS:U - The use-after-free corrupts kernel heap memory and hijacks kernel control flow within the same security authority; no VM, hypervisor, or IOMMU/DMA boundary is crossed.\nC:H - The stale worker reads the work-list head and a `struct wiphy_work *` out of the freed `rdev`, so a heap-spray reclaim of the freed allocation gives the attacker control of those pointers; combined with the `list_del_init()` write primitive this is leverageable into arbitrary kernel memory disclosure.\nI:H - `list_del_init(&wk->entry)` writes attacker-influenced values through pointers read from freed memory (write-what-where), and `wk->func(&rdev->wiphy, wk)` is an indirect call through a function pointer read from freed memory \u2014 a direct control-flow hijack enabling arbitrary code execution.\nA:H - Even without exploitation the stale `cfg80211_wiphy_work()` takes a mutex and spinlock in freed, already-`mutex_destroy`'d memory and dereferences a garbage list head, producing a KASAN splat, oops, or panic; the attacker can retrigger it in a loop."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/core.c"], "versions": [{"version": "ddb1bfbf4ab5c753954d0cd728253b642934a9f2", "lessThan": "8930a3e1568cf534f86c8ed2def817c6d0528fc1", "status": "affected", "versionType": "git"}, {"version": "3fcc6d7d5f40dad56dee7bde787b7e23edd4b93c", "lessThan": "0272d4af7f92997541d8bbf4c51918b93ded6ee2", "status": "affected", "versionType": "git"}, {"version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "lessThan": "75d262ad3c36d52852d764588fcd887f0fcd9138", "status": "affected", "versionType": "git"}, {"version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "lessThan": "a5158d67bff06cb6fea31be39aeb319fd908ed8e", "status": "affected", "versionType": "git"}, {"version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "lessThan": "dea22de162058216a90f2706f0d0b36f0ff309fd", "status": "affected", "versionType": "git"}, {"version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "lessThan": "72d520476a2fab6f3489e8388ab524985d6c4b90", "status": "affected", "versionType": "git"}, {"version": "6.1.57", "lessThan": "6.1.132", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/core.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.132", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.84", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.20", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.8", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.57", "versionEndExcluding": "6.1.132"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.13.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8930a3e1568cf534f86c8ed2def817c6d0528fc1"}, {"url": "https://git.kernel.org/stable/c/0272d4af7f92997541d8bbf4c51918b93ded6ee2"}, {"url": "https://git.kernel.org/stable/c/75d262ad3c36d52852d764588fcd887f0fcd9138"}, {"url": "https://git.kernel.org/stable/c/a5158d67bff06cb6fea31be39aeb319fd908ed8e"}, {"url": "https://git.kernel.org/stable/c/dea22de162058216a90f2706f0d0b36f0ff309fd"}, {"url": "https://git.kernel.org/stable/c/72d520476a2fab6f3489e8388ab524985d6c4b90"}], "title": "wifi: cfg80211: cancel wiphy_work before freeing wiphy", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-01T17:15:17.684537Z", "id": "CVE-2025-21979", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T17:15:20.536Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:40:19.723Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:40:19.723Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-01T17:15:17.684537Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T14:38:46.030Z"}}], "cna": {"title": "wifi: cfg80211: cancel wiphy_work before freeing wiphy", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The wiphy lifecycle operations that trigger the free (`HWSIM_CMD_NEW_RADIO`/`DEL_RADIO` generic netlink, `RTM_NEWLINK`/`DELLINK` for virt_wifi, netns teardown, module/device removal) are all local syscall/netlink operations. Remote 802.11 frames can keep wiphy_work queued but cannot themselves free the wiphy, so the attacker must have local access.\nAC:L - The attacker drives both halves \u2014 they allocate the wiphy, queue the wiphy_work, and free the wiphy, and can hit deterministic failure paths in `wiphy_new_nm()`/`mac80211_hwsim_new_radio()` or simply loop create/destroy while widening the window with CPU load. Per kernel UAF guidance an attacker-created race is Low.\nPR:L - `hwsim_new_radio_nl`/`hwsim_del_radio_nl` are gated only by `GENL_UNS_ADMIN_PERM`, i.e. `netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)` on a `.netnsok` family, so any unprivileged user obtains it via `unshare -Urn`; virt_wifi's rtnetlink create/destroy is namespaced the same way. No real root in the init namespace is needed.\nUI:N - The attacker performs the entire sequence \u2014 allocate wiphy, queue work, free wiphy \u2014 from their own process with no victim participation. No mount, file open, or any other user action is involved.\nS:U - The use-after-free corrupts kernel heap memory and hijacks kernel control flow within the same security authority; no VM, hypervisor, or IOMMU/DMA boundary is crossed.\nC:H - The stale worker reads the work-list head and a `struct wiphy_work *` out of the freed `rdev`, so a heap-spray reclaim of the freed allocation gives the attacker control of those pointers; combined with the `list_del_init()` write primitive this is leverageable into arbitrary kernel memory disclosure.\nI:H - `list_del_init(&wk->entry)` writes attacker-influenced values through pointers read from freed memory (write-what-where), and `wk->func(&rdev->wiphy, wk)` is an indirect call through a function pointer read from freed memory \u2014 a direct control-flow hijack enabling arbitrary code execution.\nA:H - Even without exploitation the stale `cfg80211_wiphy_work()` takes a mutex and spinlock in freed, already-`mutex_destroy`'d memory and dereferences a garbage list head, producing a KASAN splat, oops, or panic; the attacker can retrigger it in a loop."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ddb1bfbf4ab5c753954d0cd728253b642934a9f2", "lessThan": "8930a3e1568cf534f86c8ed2def817c6d0528fc1", "versionType": "git"}, {"status": "affected", "version": "3fcc6d7d5f40dad56dee7bde787b7e23edd4b93c", "lessThan": "0272d4af7f92997541d8bbf4c51918b93ded6ee2", "versionType": "git"}, {"status": "affected", "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "lessThan": "75d262ad3c36d52852d764588fcd887f0fcd9138", "versionType": "git"}, {"status": "affected", "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "lessThan": "a5158d67bff06cb6fea31be39aeb319fd908ed8e", "versionType": "git"}, {"status": "affected", "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "lessThan": "dea22de162058216a90f2706f0d0b36f0ff309fd", "versionType": "git"}, {"status": "affected", "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "lessThan": "72d520476a2fab6f3489e8388ab524985d6c4b90", "versionType": "git"}, {"status": "affected", "version": "6.1.57", "lessThan": "6.1.132", "versionType": "semver"}], "programFiles": ["net/wireless/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.132", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.84", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.20", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.8", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/wireless/core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8930a3e1568cf534f86c8ed2def817c6d0528fc1"}, {"url": "https://git.kernel.org/stable/c/0272d4af7f92997541d8bbf4c51918b93ded6ee2"}, {"url": "https://git.kernel.org/stable/c/75d262ad3c36d52852d764588fcd887f0fcd9138"}, {"url": "https://git.kernel.org/stable/c/a5158d67bff06cb6fea31be39aeb319fd908ed8e"}, {"url": "https://git.kernel.org/stable/c/dea22de162058216a90f2706f0d0b36f0ff309fd"}, {"url": "https://git.kernel.org/stable/c/72d520476a2fab6f3489e8388ab524985d6c4b90"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel wiphy_work before freeing wiphy\n\nA wiphy_work can be queued from the moment the wiphy is allocated and\ninitialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the\nrdev::wiphy_work is getting queued.\n\nIf wiphy_free is called before the rdev::wiphy_work had a chance to run,\nthe wiphy memory will be freed, and then when it eventally gets to run\nit'll use invalid memory.\n\nFix this by canceling the work before freeing the wiphy."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.132", "versionStartIncluding": "6.1.57"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.84", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.20", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.8", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "6.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:49.695Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21979", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:55:49.695Z", "dateReserved": "2024-12-29T08:45:45.798Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-04-01T15:47:08.699Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/wireless/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8930a3e1568cf534f86c8ed2def817c6d0528fc1", "status": "affected", "version": "ddb1bfbf4ab5c753954d0cd728253b642934a9f2", "versionType": "git"}, {"lessThan": "0272d4af7f92997541d8bbf4c51918b93ded6ee2", "status": "affected", "version": "3fcc6d7d5f40dad56dee7bde787b7e23edd4b93c", "versionType": "git"}, {"lessThan": "75d262ad3c36d52852d764588fcd887f0fcd9138", "status": "affected", "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "versionType": "git"}, {"lessThan": "a5158d67bff06cb6fea31be39aeb319fd908ed8e", "status": "affected", "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "versionType": "git"}, {"lessThan": "dea22de162058216a90f2706f0d0b36f0ff309fd", "status": "affected", "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "versionType": "git"}, {"lessThan": "72d520476a2fab6f3489e8388ab524985d6c4b90", "status": "affected", "version": "a3ee4dc84c4e9d14cb34dad095fd678127aca5b6", "versionType": "git"}, {"lessThan": "6.1.132", "status": "affected", "version": "6.1.57", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/wireless/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.132", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.84", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.20", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFE31CAB-7E14-4AA4-9EEA-4901C71DFF5A", "versionEndExcluding": "6.1.132", "versionStartIncluding": "6.1.57", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "49FD01BB-6E18-4796-A16D-F5E17FAC1E71", "versionEndExcluding": "6.6.84", "versionStartIncluding": "6.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "60E9C5DF-D778-4572-848A-5D6CFFE022CA", "versionEndExcluding": "6.12.20", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A20D4D7-B329-4C68-B662-76062EA7DCF0", "versionEndExcluding": "6.13.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*", "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*", "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*", "matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*", "matchCriteriaId": "45B90F6B-BEC7-4D4E-883A-9DBADE021750", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*", "matchCriteriaId": "1759FFB7-531C-41B1-9AE1-FD3D80E0D920", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel wiphy_work before freeing wiphy\n\nA wiphy_work can be queued from the moment the wiphy is allocated and\ninitialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the\nrdev::wiphy_work is getting queued.\n\nIf wiphy_free is called before the rdev::wiphy_work had a chance to run,\nthe wiphy memory will be freed, and then when it eventally gets to run\nit'll use invalid memory.\n\nFix this by canceling the work before freeing the wiphy."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: cancelar wiphy_work antes de liberar wiphy. Un wiphy_work puede ponerse en cola desde el momento en que se asigna e inicializa el wiphy (es decir, wiphy_new_nm). Cuando se pone en cola un wiphy_work, tambi\u00e9n se pone en cola rdev::wiphy_work. Si se llama a wiphy_free antes de que rdev::wiphy_work se ejecute, se liberar\u00e1 la memoria del wiphy y, cuando finalmente se ejecute, usar\u00e1 memoria no v\u00e1lida. Para solucionar esto, cancele el trabajo antes de liberar el wiphy."}], "id": "CVE-2025-21979", "lastModified": "2026-06-17T08:44:45.550", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21979", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T17:15:17.684537Z", "version": "2.0.3"}}]}, "published": "2025-04-01T16:15:29.287", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0272d4af7f92997541d8bbf4c51918b93ded6ee2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/72d520476a2fab6f3489e8388ab524985d6c4b90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/75d262ad3c36d52852d764588fcd887f0fcd9138"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8930a3e1568cf534f86c8ed2def817c6d0528fc1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a5158d67bff06cb6fea31be39aeb319fd908ed8e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dea22de162058216a90f2706f0d0b36f0ff309fd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:9079", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "kernel-0:6.12.0-55.17.1.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-06-16T00:00:00Z"}, {"advisory": "RHSA-2025:9080", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.22.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-06-16T00:00:00Z"}, {"advisory": "RHSA-2025:9080", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.22.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-06-16T00:00:00Z"}], "bugzilla": {"description": "kernel: wifi: cfg80211: cancel wiphy_work before freeing wiphy", "id": "2356652", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2356652"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: cfg80211: cancel wiphy_work before freeing wiphy\nA wiphy_work can be queued from the moment the wiphy is allocated and\ninitialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the\nrdev::wiphy_work is getting queued.\nIf wiphy_free is called before the rdev::wiphy_work had a chance to run,\nthe wiphy memory will be freed, and then when it eventally gets to run\nit'll use invalid memory.\nFix this by canceling the work before freeing the wiphy."], "name": "CVE-2025-21979", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21979\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21979\nhttps://lore.kernel.org/linux-cve-announce/2025040148-CVE-2025-21979-1a5f@gregkh/T"], "threat_severity": "Moderate"}

{}