CVE ID : CVE-2025-40000<\/p>\n
Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()<\/p>\n
There is a bug observed when rtw89_core_tx_kick_off_and_wait() tries to
\naccess already freed skb_data:<\/p>\n
BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait drivers\/net\/wireless\/realtek\/rtw89\/core.c:1110<\/p>\n
CPU: 6 UID: 0 PID: 41377 Comm: kworker\/u64:24 Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy)
\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05\/23\/2025
\n Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]\n
Use-after-free write at 0x0000000020309d9d (in kfence-#251):
\n rtw89_core_tx_kick_off_and_wait drivers\/net\/wireless\/realtek\/rtw89\/core.c:1110
\n rtw89_core_scan_complete drivers\/net\/wireless\/realtek\/rtw89\/core.c:5338
\n rtw89_hw_scan_complete_cb drivers\/net\/wireless\/realtek\/rtw89\/fw.c:7979
\n rtw89_chanctx_proceed_cb drivers\/net\/wireless\/realtek\/rtw89\/chan.c:3165
\n rtw89_chanctx_proceed drivers\/net\/wireless\/realtek\/rtw89\/chan.h:141
\n rtw89_hw_scan_complete drivers\/net\/wireless\/realtek\/rtw89\/fw.c:8012
\n rtw89_mac_c2h_scanofld_rsp drivers\/net\/wireless\/realtek\/rtw89\/mac.c:5059
\n rtw89_fw_c2h_work drivers\/net\/wireless\/realtek\/rtw89\/fw.c:6758
\n process_one_work kernel\/workqueue.c:3241
\n worker_thread kernel\/workqueue.c:3400
\n kthread kernel\/kthread.c:463
\n ret_from_fork arch\/x86\/kernel\/process.c:154
\n ret_from_fork_asm arch\/x86\/entry\/entry_64.S:258<\/p>\n
kfence-#251: 0x0000000056e2393d-0x000000009943cb62, size=232, cache=skbuff_head_cache<\/p>\n
allocated by task 41377 on cpu 6 at 77869.159548s (0.009551s ago):
\n __alloc_skb net\/core\/skbuff.c:659
\n __netdev_alloc_skb net\/core\/skbuff.c:734
\n ieee80211_nullfunc_get net\/mac80211\/tx.c:5844
\n rtw89_core_send_nullfunc drivers\/net\/wireless\/realtek\/rtw89\/core.c:3431
\n rtw89_core_scan_complete drivers\/net\/wireless\/realtek\/rtw89\/core.c:5338
\n rtw89_hw_scan_complete_cb drivers\/net\/wireless\/realtek\/rtw89\/fw.c:7979
\n rtw89_chanctx_proceed_cb drivers\/net\/wireless\/realtek\/rtw89\/chan.c:3165
\n rtw89_chanctx_proceed drivers\/net\/wireless\/realtek\/rtw89\/chan.c:3194
\n rtw89_hw_scan_complete drivers\/net\/wireless\/realtek\/rtw89\/fw.c:8012
\n rtw89_mac_c2h_scanofld_rsp drivers\/net\/wireless\/realtek\/rtw89\/mac.c:5059
\n rtw89_fw_c2h_work drivers\/net\/wireless\/realtek\/rtw89\/fw.c:6758
\n process_one_work kernel\/workqueue.c:3241
\n worker_thread kernel\/workqueue.c:3400
\n kthread kernel\/kthread.c:463
\n ret_from_fork arch\/x86\/kernel\/process.c:154
\n ret_from_fork_asm arch\/x86\/entry\/entry_64.S:258<\/p>\n
freed by task 1045 on cpu 9 at 77869.168393s (0.001557s ago):
\n ieee80211_tx_status_skb net\/mac80211\/status.c:1117
\n rtw89_pci_release_txwd_skb drivers\/net\/wireless\/realtek\/rtw89\/pci.c:564
\n rtw89_pci_release_tx_skbs.isra.0 drivers\/net\/wireless\/realtek\/rtw89\/pci.c:651
\n rtw89_pci_release_tx drivers\/net\/wireless\/realtek\/rtw89\/pci.c:676
\n rtw89_pci_napi_poll drivers\/net\/wireless\/realtek\/rtw89\/pci.c:4238
\n __napi_poll net\/core\/dev.c:7495
\n net_rx_action net\/core\/dev.c:7557 net\/core\/dev.c:7684
\n handle_softirqs kernel\/softirq.c:580
\n do_softirq.part.0 kernel\/softirq.c:480
\n __local_bh_enable_ip kernel\/softirq.c:407
\n rtw89_pci_interrupt_threadfn drivers\/net\/wireless\/realtek\/rtw89\/pci.c:927
\n irq_thread_fn kernel\/irq\/manage.c:1133
\n irq_thread kernel\/irq\/manage.c:1257
\n kthread kernel\/kthread.c:463
\n ret_from_fork arch\/x86\/kernel\/process.c:154
\n ret_from_fork_asm arch\/x86\/entry\/entry_64.S:258<\/p>\n
It is a consequence of a race between the waiting and the signaling side
\nof the completion:<\/p>\n
Waiting thread Completing thread<\/p>\n
rtw89_core_tx_kick_off_and_wait()
\n rcu_assign_pointer(skb_data->wait, wait)
\n \/* start waiting *\/
\n wait_for_completion_timeout()
\n rtw89_pci_tx_status()
\n rtw89_core_tx_wait_complete()
\n rcu_read_lock()
\n \/* signals completion and<\/p>\n
—truncated—<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2025-40000 Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() There is a bug observed when rtw89_core_tx_kick_off_and_wait() tries to access already freed skb_data: BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait drivers\/net\/wireless\/realtek\/rtw89\/core.c:1110 CPU: 6 UID: …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-71723","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71723","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=71723"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71723\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=71723"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=71723"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=71723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}