--- id: CVE-2025-40000 title: 'wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()' summary: |- In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() There is a bug observed when rtw89_core_tx_kick_off_and_wait() tries to access already freed skb_d… severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cvssSource: cna vendor: Linux product: Linux affected: - >- Linux >= 1ae5ca615285d5d4f72d1de464716d85dffef19f < 895cccf639ac015f3d5f993218cf098db82ac145 - >- Linux >= 1ae5ca615285d5d4f72d1de464716d85dffef19f < f21f530b03b4b23448edb531a0cfea434cb76bb4 - >- Linux >= 1ae5ca615285d5d4f72d1de464716d85dffef19f < bdb3c41b358cf87d99e39d393e164f9e4a6088e6 - >- Linux >= 1ae5ca615285d5d4f72d1de464716d85dffef19f < 3e31a6bc07312b448fad3b45de578471f86f0e77 - Linux 6.4 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-15T21:56:06.548644Z' published: '2025-10-15' updated: '2026-10-15' sourceUpdated: '2026-10-15T22:02:36.100Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40000' references: - url: 'https://git.kernel.org/stable/c/895cccf639ac015f3d5f993218cf098db82ac145' - url: 'https://git.kernel.org/stable/c/f21f530b03b4b23448edb531a0cfea434cb76bb4' - url: 'https://git.kernel.org/stable/c/bdb3c41b358cf87d99e39d393e164f9e4a6088e6' - url: 'https://git.kernel.org/stable/c/3e31a6bc07312b448fad3b45de578471f86f0e77' tags: - cve.org epss: 0.00268 epssPercentile: 0.18849 ingestedAt: '2026-10-15T22:48:25.537Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() There is a bug observed when rtw89_core_tx_kick_off_and_wait() tries to access already freed skb_data: BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110 CPU: 6 UID: 0 PID: 41377 Comm: kworker/u64:24 Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 Workqueue: events_unbound cfg80211_wiphy_work [cfg80211] Use-after-free write at 0x0000000020309d9d (in kfence-#251): rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110 rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.h:141 rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 kfence-#251: 0x0000000056e2393d-0x000000009943cb62, size=232, cache=skbuff_head_cache allocated by task 41377 on cpu 6 at 77869.159548s (0.009551s ago): __alloc_skb net/core/skbuff.c:659 __netdev_alloc_skb net/core/skbuff.c:734 ieee80211_nullfunc_get net/mac80211/tx.c:5844 rtw89_core_send_nullfunc drivers/net/wireless/realtek/rtw89/core.c:3431 rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.c:3194 rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 freed by task 1045 on cpu 9 at 77869.168393s (0.001557s ago): ieee80211_tx_status_skb net/mac80211/status.c:1117 rtw89_pci_release_txwd_skb drivers/net/wireless/realtek/rtw89/pci.c:564 rtw89_pci_release_tx_skbs.isra.0 drivers/net/wireless/realtek/rtw89/pci.c:651 rtw89_pci_release_tx drivers/net/wireless/realtek/rtw89/pci.c:676 rtw89_pci_napi_poll drivers/net/wireless/realtek/rtw89/pci.c:4238 __napi_poll net/core/dev.c:7495 net_rx_action net/core/dev.c:7557 net/core/dev.c:7684 handle_softirqs kernel/softirq.c:580 do_softirq.part.0 kernel/softirq.c:480 __local_bh_enable_ip kernel/softirq.c:407 rtw89_pci_interrupt_threadfn drivers/net/wireless/realtek/rtw89/pci.c:927 irq_thread_fn kernel/irq/manage.c:1133 irq_thread kernel/irq/manage.c:1257 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 It is a consequence of a race between the waiting and the signaling side of the completion: Waiting thread Completing thread rtw89_core_tx_kick_off_and_wait() rcu_assign_pointer(skb_data->wait, wait) /* start waiting */ wait_for_completion_timeout() rtw89_pci_tx_status() rtw89_core_tx_wait_complete() rcu_read_lock() /* signals completion and ---truncated--- ## Affected - `Linux >= 1ae5ca615285d5d4f72d1de464716d85dffef19f < 895cccf639ac015f3d5f993218cf098db82ac145` - `Linux >= 1ae5ca615285d5d4f72d1de464716d85dffef19f < f21f530b03b4b23448edb531a0cfea434cb76bb4` - `Linux >= 1ae5ca615285d5d4f72d1de464716d85dffef19f < bdb3c41b358cf87d99e39d393e164f9e4a6088e6` - `Linux >= 1ae5ca615285d5d4f72d1de464716d85dffef19f < 3e31a6bc07312b448fad3b45de578471f86f0e77` - `Linux 6.4` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.