{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-21730",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2024-12-29T08:45:45.755Z",
        "datePublished": "2025-02-27T02:07:35.317Z",
        "dateUpdated": "2026-08-05T11:54:02.376Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T11:54:02.376Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid to init mgnt_entry list twice when WoWLAN failed\n\nIf WoWLAN failed in resume flow, the rtw89_ops_add_interface() triggered\nwithout removing the interface first. Then the mgnt_entry list init again,\ncausing the list_empty() check in rtw89_chanctx_ops_assign_vif()\nuseless, and list_add_tail() again. Therefore, we have added a check to\nprevent double adding of the list.\n\nrtw89_8852ce 0000:01:00.0: failed to check wow status disabled\nrtw89_8852ce 0000:01:00.0: wow: failed to check disable fw ready\nrtw89_8852ce 0000:01:00.0: wow: failed to swap to normal fw\nrtw89_8852ce 0000:01:00.0: failed to disable wow\nrtw89_8852ce 0000:01:00.0: failed to resume for wow -110\nrtw89_8852ce 0000:01:00.0: MAC has already powered on\ni2c_hid_acpi i2c-ILTK0001:00: PM: acpi_subsys_resume+0x0/0x60 returned 0 after 284705 usecs\nlist_add corruption. prev->next should be next (ffff9d9719d82228), but was ffff9d9719f96030. (prev=ffff9d9719f96030).\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:34!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 2 PID: 6918 Comm: kworker/u8:19 Tainted: G     U     O\nHardware name: Google Anraggar/Anraggar, BIOS Google_Anraggar.15217.514.0 03/25/2024\nWorkqueue: events_unbound async_run_entry_fn\nRIP: 0010:__list_add_valid_or_report+0x9f/0xb0\nCode: e8 56 89 ff ff 0f 0b 48 c7 c7 3e fc e0 96 48 89 c6 e8 45 89 ff ...\nRSP: 0018:ffffa51b42bbbaf0 EFLAGS: 00010246\nRAX: 0000000000000075 RBX: ffff9d9719d82ab0 RCX: 13acb86e047a4400\nRDX: 3fffffffffffffff RSI: 0000000000000000 RDI: 00000000ffffdfff\nRBP: ffffa51b42bbbb28 R08: ffffffff9768e250 R09: 0000000000001fff\nR10: ffffffff9765e250 R11: 0000000000005ffd R12: ffff9d9719f95c40\nR13: ffff9d9719f95be8 R14: ffff9d97081bfd78 R15: ffff9d9719d82060\nFS:  0000000000000000(0000) GS:ffff9d9a6fb00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007e7d029a4060 CR3: 0000000345e38000 CR4: 0000000000750ee0\nPKRU: 55555554\nCall Trace:\n <TASK>\n ? __die_body+0x68/0xb0\n ? die+0xaa/0xd0\n ? do_trap+0x9f/0x170\n ? __list_add_valid_or_report+0x9f/0xb0\n ? __list_add_valid_or_report+0x9f/0xb0\n ? handle_invalid_op+0x69/0x90\n ? __list_add_valid_or_report+0x9f/0xb0\n ? exc_invalid_op+0x3c/0x50\n ? asm_exc_invalid_op+0x16/0x20\n ? __list_add_valid_or_report+0x9f/0xb0\n rtw89_chanctx_ops_assign_vif+0x1f9/0x210 [rtw89_core cbb375c44bf28564ce479002bff66617a25d9ac1]\n ? __mutex_unlock_slowpath+0xa0/0xf0\n rtw89_ops_assign_vif_chanctx+0x4b/0x90 [rtw89_core cbb375c44bf28564ce479002bff66617a25d9ac1]\n drv_assign_vif_chanctx+0xa7/0x1f0 [mac80211 6efaad16237edaaea0868b132d4f93ecf918a8b6]\n ieee80211_reconfig+0x9cb/0x17b0 [mac80211 6efaad16237edaaea0868b132d4f93ecf918a8b6]\n ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 572d03acaaa933fe38251be7fce3b3675284b8ed]\n ? dev_printk_emit+0x51/0x70\n ? _dev_info+0x6e/0x90\n wiphy_resume+0x89/0x180 [cfg80211 572d03acaaa933fe38251be7fce3b3675284b8ed]\n ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 572d03acaaa933fe38251be7fce3b3675284b8ed]\n dpm_run_callback+0x37/0x1e0\n device_resume+0x26d/0x4b0\n ? __pfx_dpm_watchdog_handler+0x10/0x10\n async_resume+0x1d/0x30\n async_run_entry_fn+0x29/0xd0\n worker_thread+0x397/0x970\n kthread+0xed/0x110\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x38/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n </TASK>"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The defect is in the rtw89 driver's suspend/resume state machine and is reached through a local system suspend/resume cycle on the affected host, not through any received frame or packet. No network or adjacent-radio input is needed to drive the double list insertion.\nAC:L - The suspend/resume cycle that drives the reconfig path is fully repeatable by the attacker at zero cost, and the WoWLAN-disable failure is a real, field-observed outcome, so unbounded retries make the trigger reliable. Once the reconfig path runs, the `INIT_LIST_HEAD` on a still-linked node followed by `list_add_tail()` is deterministic, not a race.\nPR:L - An unprivileged user in an active local session can request suspend via logind/systemd (polkit permits this for active local sessions by default) on a system where WoWLAN is already configured by NetworkManager or the platform, as it is by default on the laptops and Chromebooks that ship rtw89 8852/8922 parts. No root or CAP_NET_ADMIN is required to drive the cycle itself.\nUI:N - Suspend and resume proceed automatically on these platforms via idle timeout or lid events, and the attacker can also initiate the cycle directly, so no separate victim action is needed. The reconfig, add_interface and assign_vif_chanctx sequence runs entirely in the kernel's async resume worker.\nS:U - The corrupted list heads live in the driver's own `rtw89_dev`/`rtw89_vif` structures and all consequences stay inside the kernel that owns the device. No VM, IOMMU, or other security-authority boundary is crossed.\nC:H - The double insertion is doubly-linked-list memory corruption: it can leave `entity_mgnt.active_list` pointing at a node whose containing `ieee80211_vif` is later freed, so subsequent traversals in `rtw89_entity_recalc_mgnt_roles()` dereference reallocated slab memory. Combined with heap grooming that gives an attacker-influenced read of kernel memory through the traversal, warranting High.\nI:H - After the list is corrupted, the `list_del()`/`list_add()` pair in `rtw89_entity_recalc_mgnt_roles()` performs `next->prev = prev` style stores through pointers held in a freed and potentially attacker-reallocated object, which is a classic arbitrary-write primitive. The orphaned-entry variant also silently drops a live interface from the driver's active-role bookkeeping, corrupting channel-context state.\nA:H - The reported outcome is a hard kernel panic — `kernel BUG at lib/list_debug.c:34`, `invalid opcode` in `__list_add_valid_or_report()` — on kernels with CONFIG_DEBUG_LIST. Without that option the node self-loops and `list_for_each_entry()` over `active_list` spins forever while holding `rtwdev->mutex`, hanging the resume worker and wedging the wiphy."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wireless/realtek/rtw89/mac80211.c"
                    ],
                    "versions": [
                        {
                            "version": "0007546cb406be0dddf3d43f07683825affc6d4d",
                            "lessThan": "7fc295fdd3992a9a07d12fd3f2e84dface23aedc",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "68ec751b288178de7d19b71ea61648269a35b8cd",
                            "lessThan": "4ed5bf49819757303e657f3900725febf2f3926f",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "68ec751b288178de7d19b71ea61648269a35b8cd",
                            "lessThan": "2f7667675df1b40b73ecc53b4b8c3189b1e5f2c1",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wireless/realtek/rtw89/mac80211.c"
                    ],
                    "versions": [
                        {
                            "version": "6.13",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.13",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.13.2",
                            "lessThanOrEqual": "6.13.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.14",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "6.13.2"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "6.14"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/7fc295fdd3992a9a07d12fd3f2e84dface23aedc"
                },
                {
                    "url": "https://git.kernel.org/stable/c/4ed5bf49819757303e657f3900725febf2f3926f"
                },
                {
                    "url": "https://git.kernel.org/stable/c/2f7667675df1b40b73ecc53b4b8c3189b1e5f2c1"
                }
            ],
            "title": "wifi: rtw89: avoid to init mgnt_entry list twice when WoWLAN failed",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}