CVE-2025-21729 Overview
CVE-2025-21729 is a use-after-free vulnerability in the Linux kernel's rtw89 Realtek Wi-Fi driver. The flaw exists in the hardware scan cancellation path, where the rtwdev->scanning flag is not protected by a mutex. A race between cancel_hw_scan and hardware scan completion allows the completion handler to free local->hw_scan_req via ieee80211_scan_completed() while cancel_hw_scan continues executing. The subsequent access triggers a null-pointer dereference and use-after-free in rtw89_fw_h2c_scan_offload_be. The issue is tracked under [CWE-416: Use After Free].
Critical Impact
A local attacker with the ability to trigger Wi-Fi scan operations can cause kernel memory corruption, leading to denial of service or potential local privilege escalation on systems using the rtw89 driver.
Affected Products
- Linux Kernel versions containing the rtw89 wireless driver prior to the fix
- Systems using Realtek Wi-Fi 6/6E chipsets supported by rtw89_core
- Distributions shipping affected stable kernel branches
Discovery Timeline
- 2025-02-27 - CVE-2025-21729 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21729
Vulnerability Analysis
The vulnerability resides in the rtw89 driver's hardware scan cancellation logic. Two concurrent execution paths access shared state without adequate synchronization. The first path is rtw89_ops_cancel_hw_scan(), which invokes rtw89_hw_scan_abort() and eventually reaches rtw89_fw_h2c_scan_offload_be(). The second path is the hardware scan completion handler, which unsets rtwdev->scanning and calls ieee80211_scan_completed() in the mac80211 subsystem.
Because rtwdev->scanning is checked outside of mutex protection, cancel_hw_scan observes an active scan and proceeds. Before it acquires the mutex, the completion handler runs and frees local->hw_scan_req. When cancel_hw_scan later dereferences the freed structure inside rtw89_fw_h2c_scan_offload_be, the kernel triggers a null-pointer dereference and use-after-free. KASAN captured the fault as null-ptr-deref in range [0x0000000000000088-0x000000000000008f].
Root Cause
The root cause is a time-of-check to time-of-use (TOCTOU) race. The rtwdev->scanning flag is read without holding rtwdev->mutex, allowing the state to change between the check and subsequent use. The upstream fix relocates the condition check to a region already protected by the driver's mutex, ensuring atomic evaluation of scan state and freed pointer references.
Attack Vector
Exploitation requires local access and the ability to initiate or cancel Wi-Fi scan operations. Triggering the race requires concurrent scan requests, for example through repeated nl80211 scan and connection attempts via cfg80211_conn_work. The call trace shows the fault reached via ieee80211_prep_connection and ieee80211_scan_cancel, both invokable from unprivileged network manager workflows on many distributions.
No public exploit is available. Refer to the upstream commits 2403cb3c235d, 5afcd6fcd1e1, and ba4bb0402c60 for the patched code.
Detection Methods for CVE-2025-21729
Indicators of Compromise
- Kernel oops or panic messages referencing rtw89_fw_h2c_scan_offload_be in the call trace
- KASAN reports containing null-ptr-deref or use-after-free originating from rtw89_core
- Unexpected wireless interface resets or wpa_supplicant disconnects following scan operations
Detection Strategies
- Monitor dmesg and journalctl -k for stack traces containing rtw89_hw_scan_abort or rtw89_ops_cancel_hw_scan
- Correlate kernel crash telemetry with running kernel versions to identify unpatched hosts using the rtw89 driver
- Audit installed kernel packages against distribution advisories referencing CVE-2025-21729
Monitoring Recommendations
- Ingest kernel logs into a centralized logging platform and alert on repeated rtw89 module faults
- Track workload processes issuing frequent nl80211 scan requests, which may indicate reproduction attempts
- Enable kdump on Linux endpoints to capture crash artifacts for post-incident analysis
How to Mitigate CVE-2025-21729
Immediate Actions Required
- Update the Linux kernel to a stable release that includes the three upstream commits referenced in the advisory
- Inventory endpoints and servers using Realtek Wi-Fi hardware managed by the rtw89 driver
- Prioritize patching for shared workstations and laptops where local users can trigger scan activity
Patch Information
The fix moves the rtwdev->scanning condition check into a mutex-protected region, eliminating the race. Patches are available in the mainline kernel through commits 2403cb3c235d, 5afcd6fcd1e1, and ba4bb0402c60. Apply the corresponding stable kernel update from your distribution vendor.
Workarounds
- Blacklist the rtw89_core, rtw89_pci, and related modules on systems where Wi-Fi is not required
- Disable hardware-offloaded scanning where the driver exposes a runtime toggle
- Restrict local access on affected hosts until patched kernels are deployed
# Blacklist the rtw89 driver until a patched kernel is installed
echo "blacklist rtw89_core" | sudo tee /etc/modprobe.d/blacklist-rtw89.conf
echo "blacklist rtw89_pci" | sudo tee -a /etc/modprobe.d/blacklist-rtw89.conf
sudo update-initramfs -u
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
