CVE-2025-40000
NoneCVSS
—
EPSS
0.3%
Published
Oct 15, 2025
CISA due date
—
Cloudanix analysis
A bug in the Linux WiFi driver can let programs on the same computer corrupt memory and crash the system or gain higher privileges until the operating system is updated.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free write in rtw89_core_tx_kick_off_and_wait() caused by a race between the waiting thread (which assigns skb_data->wait via rcu_assign_pointer) and the completing thread (rtw89_pci_tx_status calling rtw89_core_tx_wait_complete), allowing access to an skb freed by ieee80211_tx_status_skb after the completion is signaled.
Why it matters to the business
Kernel crashes or memory corruption on affected Linux systems using Realtek rtw89 WiFi hardware, leading to denial of service, potential local privilege escalation, and operational disruption until systems are updated; widespread impact given the driver's presence in mainline kernels and downstream distributions.
How an attack unfolds
An attacker with local access or the ability to influence WiFi scan/tx operations triggers concurrent execution of rtw89_core_scan_complete and rtw89_pci_release_tx paths, racing the wait_for_completion_timeout against rtw89_core_tx_wait_complete to write to freed skbuff memory; no public in-the-wild exploitation noted but similar kernel UAFs have been chained by threat actors for container escapes.
How to fix it
Update to a fixed kernel containing commit 895cccf639ac015f3d5f993218cf098db82ac145; for SUSE Linux Enterprise Server 12-LTSS apply kgraft-patch-SLE12_Update_36 (version 2-2.1) or later; rebuild and reboot with the patched kernel module.
How to confirm the fix worked
Verify kernel source contains commit 895cccf639ac015f3d5f993218cf098db82ac145 or check dmesg for absence of the KFENCE use-after-free signature in rtw89_core_tx_kick_off_and_wait; confirm module version via modinfo rtw89_core after upgrade.
Typical attack path
- Gain local execution or control WiFi interface on target system
- Trigger hardware scan or nullfunc transmission via cfg80211/mac80211 paths
- Force race between tx kick-off wait and pci tx status release in workqueue/irq context
- Write to freed skb_data pointer causing KFENCE-detected corruption or crash
- Chain resulting UAF for privilege escalation or denial of service
How to detect it
Search kernel logs and dmesg for BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait and stack traces involving rtw89_pci_release_tx_skbs or rtw89_core_scan_complete; inspect workqueue and napi_poll activity around skbuff_head_cache allocations.
- BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait
- rtw89_core_tx_kick_off_and_wait+0x
- rtw89_pci_release_tx_skbs.isra.0
- skbuff_head_cache
- drivers/net/wireless/realtek/rtw89/core.c:1110
What your security team should do
- Immediately apply the referenced kernel commit or distribution patch across all affected hosts
- Prioritize systems with Realtek rtw89 WiFi hardware and container workloads
- Monitor for kernel oops reports referencing core.c:1110 until patching completes
- Test reboot and WiFi functionality post-upgrade before broad deployment
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() There is a bug observed when rtw89_core_tx_kick_off_and_wait() tries to access already freed skb_data: BUG: KFENCE: use-after-free write in rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110 CPU: 6 UID: 0 PID: 41377 Comm: kworker/u64:24 Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 Workqueue: events_unbound cfg80211_wiphy_work [cfg80211] Use-after-free write at 0x0000000020309d9d (in kfence-#251): rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110 rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.h:141 rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 kfence-#251: 0x0000000056e2393d-0x000000009943cb62, size=232, cache=skbuff_head_cache allocated by task 41377 on cpu 6 at 77869.159548s (0.009551s ago): __alloc_skb net/core/skbuff.c:659 __netdev_alloc_skb net/core/skbuff.c:734 ieee80211_nullfunc_get net/mac80211/tx.c:5844 rtw89_core_send_nullfunc drivers/net/wireless/realtek/rtw89/core.c:3431 rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed drivers/net/wireless/realtek/rtw89/chan.c:3194 rtw89_hw_scan_complete drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 freed by task 1045 on cpu 9 at 77869.168393s (0.001557s ago): ieee80211_tx_status_skb net/mac80211/status.c:1117 rtw89_pci_release_txwd_skb drivers/net/wireless/realtek/rtw89/pci.c:564 rtw89_pci_release_tx_skbs.isra.0 drivers/net/wireless/realtek/rtw89/pci.c:651 rtw89_pci_release_tx drivers/net/wireless/realtek/rtw89/pci.c:676 rtw89_pci_napi_poll drivers/net/wireless/realtek/rtw89/pci.c:4238 __napi_poll net/core/dev.c:7495 net_rx_action net/core/dev.c:7557 net/core/dev.c:7684 handle_softirqs kernel/softirq.c:580 do_softirq.part.0 kernel/softirq.c:480 __local_bh_enable_ip kernel/softirq.c:407 rtw89_pci_interrupt_threadfn drivers/net/wireless/realtek/rtw89/pci.c:927 irq_thread_fn kernel/irq/manage.c:1133 irq_thread kernel/irq/manage.c:1257 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154 ret_from_fork_asm arch/x86/entry/entry_64.S:258 It is a consequence of a race between the waiting and the signaling side of the completion: Waiting thread Completing thread rtw89_core_tx_kick_off_and_wait() rcu_assign_pointer(skb_data->wait, wait) /* start waiting */ wait_for_completion_timeout() rtw89_pci_tx_status() rtw89_core_tx_wait_complete() rcu_read_lock() /* signals completion and ---truncated---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Linux | Kernel | 6.4.0 | 6.12.52 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_17 | 0 | 1-150600.1.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_17 | 0 | 1-150600.13.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_6 | 0 | 1-150700.15.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.78.1.150600.12.34.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-64kb | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default-base | 0 | 6.4.0-150700.53.22.1.150700.17.15.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-zfcpdump | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-docs | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-obs-build | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-syms | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.55.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.55.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.55.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-source-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-syms-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.55.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.78.1.150600.12.34.2 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.55.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.55.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 16.0 | dtb-aarch64 | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-64kb | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-default | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-default-base | 0 | 6.12.0-160000.6.1.160000.2.4 |
| openSUSE:Leap 16.0 | kernel-docs | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-kvmsmall | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-obs-build | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-obs-qa | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-rt | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-source | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-syms | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-zfcpdump | 0 | 6.12.0-160000.7.1 |
| openSUSE:Tumbleweed | kernel-source | 0 | 6.17.5-1.1 |
| openSUSE:Tumbleweed | kernel-source-longterm | 0 | 6.18.16-1.1 |
Related vulnerabilities
- CVE-2026-23226 In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock… Also affects Kernel
- CVE-2026-23225 In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't… Also affects Kernel
- CVE-2026-23230 In the Linux kernel, the following vulnerability has been resolved: smb: client: split… Also affects Kernel
- CVE-2026-23224 In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue… Also affects Kernel
- CVE-2026-23227 In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use… Also affects Kernel
- CVE-2026-23223 In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in… Also affects Kernel
- CVE-2026-23228 In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak… Also affects Kernel
- CVE-2026-23229 In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add… Also affects Kernel