Race Condition in Linux Kernel Affecting rtw89 Wi-Fi Driver

CVE-2025-21729

Summary

The Linux kernel's rtw89 Wi-Fi driver has a race condition vulnerability that occurs between the cancellation of a hardware scan and its completion. The issue arises when the 'scanning' flag is not adequately protected, allowing the 'cancel_hw_scan' function to proceed erroneously. If this happens during the hardware scan's completion, it may lead to a null pointer dereference and a use-after-free situation. The vulnerability has been addressed by restructuring the checking conditions to ensure proper mutex protection during the scan processes.

References