CVE-2025-21979: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21979 Overview

CVE-2025-21979 is a use-after-free vulnerability [CWE-416] in the Linux kernel's cfg80211 wireless configuration subsystem. The flaw resides in the wiphy lifecycle management path, where a queued wiphy_work item can execute after the underlying wiphy structure has already been freed by wiphy_free. When the deferred work eventually runs, it dereferences invalid memory belonging to the freed rdev::wiphy_work structure.

The issue affects Linux kernel 6.14 release candidates and earlier stable branches. Local attackers with low privileges can trigger the race condition to corrupt kernel memory.

Critical Impact
Successful exploitation can lead to kernel memory corruption, local privilege escalation, or denial of service on systems using the affected wireless stack.

Affected Products

Linux kernel 6.14-rc1 through 6.14-rc6
Linux kernel stable branches prior to the fix commits
Debian LTS distributions shipping affected kernels

Discovery Timeline

2025-04-01 - CVE-2025-21979 published to NVD
2025-05 - Debian LTS security announcement released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21979

Vulnerability Analysis

The cfg80211 subsystem in the Linux kernel manages wireless device configuration through a wiphy structure. A wiphy_work item is a deferred work queue mechanism used to run asynchronous tasks associated with a wireless PHY device. Once a wiphy is allocated and initialized via wiphy_new_nm, work can be queued against it.

The vulnerability arises because wiphy_free does not cancel pending wiphy_work items before releasing the memory backing the wiphy structure. If wiphy_free executes while rdev::wiphy_work is still queued but has not yet run, the kernel frees the containing memory. When the work handler is later dispatched, it accesses freed memory, producing a classic use-after-free condition.

The fix, distributed across commits 0272d4af7f, 72d520476a, 75d262ad3c, 8930a3e156, a5158d67bf, and dea22de162, adds an explicit cancel of the pending work before the wiphy structure is released.

Root Cause

The root cause is missing synchronization between the wiphy teardown path and the deferred work queue. wiphy_free releases memory without ensuring that any queued wiphy_work has completed or been cancelled, violating the object lifetime contract expected by the work queue subsystem.

Attack Vector

Exploitation requires local access with low privileges on a system with an active wireless stack. A local attacker triggers repeated registration and teardown of wireless PHY devices to race the wiphy_work execution against wiphy_free. Successful exploitation of the freed memory region enables kernel memory corruption. Refer to the upstream commits in the Linux kernel stable tree for the authoritative fix details.

// No verified public proof-of-concept exists for CVE-2025-21979.
// The vulnerable sequence involves:
//   1. wiphy_new_nm() allocates the wiphy structure
//   2. wiphy_work is queued via rdev::wiphy_work
//   3. wiphy_free() releases the wiphy memory
//   4. The pending work runs against freed memory (UAF)

Detection Methods for CVE-2025-21979

Indicators of Compromise

Kernel oops or panic messages referencing cfg80211, wiphy_work, or slab-use-after-free reports from KASAN.
Unexpected wireless subsystem crashes during interface teardown or driver unload.
dmesg entries showing corrupted work queue pointers or scheduling anomalies tied to wireless PHY devices.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in test environments to surface use-after-free access patterns in cfg80211.
Audit installed kernel versions against the fix commits to identify unpatched hosts.
Correlate crash reports from wireless-enabled systems with wiphy registration and deregistration events.

Monitoring Recommendations

Ship kernel logs and crash dumps to a centralized logging pipeline and alert on cfg80211 stack traces.
Monitor loading and unloading of wireless drivers on production servers where such activity is unexpected.
Track kernel package versions across the fleet to confirm patch coverage on the Linux wireless subsystem.

How to Mitigate CVE-2025-21979

Immediate Actions Required

Apply the vendor-supplied kernel update that contains the cfg80211: cancel wiphy_work before freeing wiphy fix.
Prioritize patching of laptops, workstations, and edge devices that expose wireless interfaces to untrusted users.
Restrict local shell access on multi-tenant systems until patched kernels are deployed.

Patch Information

The upstream fix is available in the Linux stable tree via commits 0272d4af7f, 72d520476a, 75d262ad3c, 8930a3e156, a5158d67bf, and dea22de162. Debian LTS users should apply the update announced in the Debian LTS advisory. Consult your distribution's security tracker to confirm the corresponding backport version.

Workarounds

Disable the wireless subsystem on systems that do not require it by blacklisting cfg80211 and dependent driver modules.
Limit unprivileged user access to interfaces that manage wireless PHY devices, such as nl80211 netlink sockets.
Reduce the local attack surface by enforcing least-privilege on shell users and hardening sysctl settings that control kernel exposure.

bash

# Verify running kernel version and package status
uname -r
apt list --installed 2>/dev/null | grep linux-image

# Example: blacklist cfg80211 where wireless is not needed
echo "blacklist cfg80211" | sudo tee /etc/modprobe.d/disable-cfg80211.conf
sudo update-initramfs -u