CVE-2025-21909

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21909
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject cooked mode if it is set along with other flags It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor interface from the userspace. This causes a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit set because the monitor interface is in the cooked state and it takes precedence over all other states. When the interface is then being deleted the kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing that bit. Fix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with other flags. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/236f41ca728f23210b31ed2d1d8a6df575a4b2d6 Patch
https://git.kernel.org/stable/c/351eb7ac53ff1cd94d893c0c4534ced2f36ae7d7 Patch
https://git.kernel.org/stable/c/49f27f29446a5bfe633dd2cc0cfebd48a1a5e77f Patch
https://git.kernel.org/stable/c/521e55c2b0d6028861ac0a2d06aa57bb0e3ac486 Patch
https://git.kernel.org/stable/c/5ea856d93794c4afa5542defd8c61f2708dc245a Patch
https://git.kernel.org/stable/c/ac4860141300581d3e2f6c6dafa37220f7ea9f65 Patch
https://git.kernel.org/stable/c/cd1bdcb77fdc03c253137e55bae10551b3481461 Patch
https://git.kernel.org/stable/c/ebebbb0eded2ed9a1abfa31962f6fb699e6abce7 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
History

31 Oct 2025, 18:03

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: nl80211: rechaza el modo cocinado si se configura junto con otras banderas. Es posible configurar simultáneamente las banderas MONITOR_FLAG_COOK_FRAMES y MONITOR_FLAG_ACTIVE en la misma interfaz de monitor desde el espacio de usuario. Esto provoca que se cree una subinterfaz sin el bit IEEE80211_SDATA_IN_DRIVER configurado, ya que la interfaz de monitor está en estado cocinado y tiene prioridad sobre todos los demás estados. Al eliminar la interfaz, el kernel llama a WARN_ONCE() desde check_sdata_in_driver() debido a la falta de ese bit. Solucione esto rechazando MONITOR_FLAG_COOK_FRAMES si se configura junto con otras banderas. Encontrado por el Centro de Verificación de Linux (linuxtesting.org) con Syzkaller.
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/236f41ca728f23210b31ed2d1d8a6df575a4b2d6 - () https://git.kernel.org/stable/c/236f41ca728f23210b31ed2d1d8a6df575a4b2d6 - Patch
References () https://git.kernel.org/stable/c/351eb7ac53ff1cd94d893c0c4534ced2f36ae7d7 - () https://git.kernel.org/stable/c/351eb7ac53ff1cd94d893c0c4534ced2f36ae7d7 - Patch
References () https://git.kernel.org/stable/c/49f27f29446a5bfe633dd2cc0cfebd48a1a5e77f - () https://git.kernel.org/stable/c/49f27f29446a5bfe633dd2cc0cfebd48a1a5e77f - Patch
References () https://git.kernel.org/stable/c/521e55c2b0d6028861ac0a2d06aa57bb0e3ac486 - () https://git.kernel.org/stable/c/521e55c2b0d6028861ac0a2d06aa57bb0e3ac486 - Patch
References () https://git.kernel.org/stable/c/5ea856d93794c4afa5542defd8c61f2708dc245a - () https://git.kernel.org/stable/c/5ea856d93794c4afa5542defd8c61f2708dc245a - Patch
References () https://git.kernel.org/stable/c/ac4860141300581d3e2f6c6dafa37220f7ea9f65 - () https://git.kernel.org/stable/c/ac4860141300581d3e2f6c6dafa37220f7ea9f65 - Patch
References () https://git.kernel.org/stable/c/cd1bdcb77fdc03c253137e55bae10551b3481461 - () https://git.kernel.org/stable/c/cd1bdcb77fdc03c253137e55bae10551b3481461 - Patch
References () https://git.kernel.org/stable/c/ebebbb0eded2ed9a1abfa31962f6fb699e6abce7 - () https://git.kernel.org/stable/c/ebebbb0eded2ed9a1abfa31962f6fb699e6abce7 - Patch
CWE CWE-362

01 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 16:15

Updated : 2025-10-31 18:03

NVD link : CVE-2025-21909

Mitre link : CVE-2025-21909

CVE.ORG link : CVE-2025-21909

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')