CVE-2025-21979 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2025-21979?

CVE-2025-21979 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's WiFi subsystem (cfg80211). When a wireless interface (wiphy) is freed before a scheduled work item (wiphy_work) runs, the work item may access freed memory, potentially leading to kernel crashes or code execution. This affects Linux systems using the cfg80211 WiFi framework.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's WiFi subsystem (cfg80211). When a wireless interface (wiphy) is freed before a scheduled work item (wiphy_work) runs, the work item may access freed memory, potentially leading to kernel crashes or code execution. This affects Linux systems using the cfg80211 WiFi framework.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but likely multiple stable kernel versions before the fix commits

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WiFi hardware and cfg80211 subsystem to be active. Systems without WiFi interfaces or with WiFi disabled may not be vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential kernel code execution with root privileges, resulting in complete system compromise.

🟠

Likely Case

Kernel panic causing system instability or crashes, requiring reboot to restore functionality.

🟢

If Mitigated

System remains stable with no impact if patched or if specific conditions aren't met.

🌐 Internet-Facing: MEDIUM - Requires WiFi interface to be present and configured, but exploitation could potentially be triggered remotely via WiFi protocols.

🏢 Internal Only: MEDIUM - Local users or processes could potentially trigger the vulnerability through WiFi interface operations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering specific timing conditions between wiphy_free and wiphy_work execution. Likely requires local access or ability to interact with WiFi subsystem.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 0272d4af7f92997541d8bbf4c51918b93ded6ee2, 72d520476a2fab6f3489e8388ab524985d6c4b90, 75d262ad3c36d52852d764588fcd887f0fcd9138, 8930a3e1568cf534f86c8ed2def817c6d0528fc1, a5158d67bff06cb6fea31be39aeb319fd908ed8e

Vendor Advisory: https://git.kernel.org/stable/c/0272d4af7f92997541d8bbf4c51918b93ded6ee2

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable WiFi interfaces

linux

Disable WiFi hardware to prevent cfg80211 subsystem from being used

sudo ip link set wlan0 down
sudo rfkill block wifi

Remove WiFi kernel modules

linux

Unload WiFi-related kernel modules to disable vulnerable subsystem

sudo modprobe -r cfg80211
sudo modprobe -r mac80211

🧯 If You Can't Patch

Disable WiFi interfaces completely using rfkill or network configuration
Implement strict access controls to prevent unauthorized users from interacting with WiFi subsystem

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if it includes the fix commits. Use: git log --oneline | grep -E '0272d4af7f9|72d520476a2|75d262ad3c3|8930a3e1568|a5158d67bff'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and includes the fix commits. Check that WiFi functionality still works properly after patch.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
OOPs (kernel crash) messages related to cfg80211 or WiFi subsystem
System crashes or reboots after WiFi operations

Network Indicators:

Unusual WiFi interface state changes
Multiple WiFi interface resets

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "BUG") AND ("cfg80211" OR "wiphy" OR "WiFi")

📊 Metadata

CVE ID: CVE-2025-21979

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.06% exploit probability (19.6th percentile)

Published: April 1, 2025

Last Updated: February 6, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21979, you might also want to check these: