CVE-2025-21729

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion

The rtwdev->scanning flag isn't protected by mutex originally, so

cancel_hw_scan can pass the condition, but suddenly hw_scan completion

unset the flag and calls ieee80211_scan_completed() that will free

local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and

use-after-free. Fix it by moving the check condition to where

protected by mutex.

KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]

CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE

Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019

Workqueue: events cfg80211_conn_work [cfg80211]

RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core]

Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d

RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206

RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001

RDX:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References