LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21909: wifi: nl80211: reject cooked mode if it is set along with other flags

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject cooked mode if it is set along with other flags It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor interface from the userspace. This causes a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit set because the monitor interface is in the cooked state and it takes precedence over all other states. When the interface is then being deleted the kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing that bit. Fix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with other flags. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-21909 is a Linux kernel Wi-Fi bug in monitor-interface flag handling. A userspace request can set an invalid combination of monitor flags, leading to a kernel WARN_ONCE during interface deletion. Public sources describe a correctness/stability issue, not data theft or remote compromise.

Executive priority

Treat as routine-to-priority Linux kernel maintenance, not an emergency. Patch affected Wi-Fi-capable Linux systems through normal kernel update channels, faster where untrusted users or workloads can manage network interfaces.

Technical view

In nl80211/mac80211, MONITOR_FLAG_COOK_FRAMES can be combined with other monitor flags, including ACTIVE. Cooked mode takes precedence, causing a sub-interface without IEEE80211_SDATA_IN_DRIVER. Deletion then triggers check_sdata_in_driver() WARN_ONCE. Stable kernel commits reject cooked mode when combined with other flags.

Likely exposure

Likely limited to Linux systems with Wi-Fi stack support where userspace can create or modify monitor interfaces. No provided source indicates remote exploitation. Exposure should be assessed on laptops, wireless appliances, testing systems, and servers with Wi-Fi hardware or loaded wireless modules.

Exploitation context

The issue was found by Linux Verification Center using Syzkaller. The source bundle does not report public exploitation, weaponized proof-of-concept activity, or CISA KEV listing. Triggering requires manipulating nl80211 monitor-interface flags from userspace.

Researcher notes

Severity metadata is incomplete: no CVSS or CWE is provided in the bundle. The described outcome is a WARN_ONCE path from invalid monitor flag state. Analysis should avoid assuming privilege escalation or remote attack unless later vendor advisories add impact details.

Mitigation direction

  • Apply a vendor kernel update containing the stable upstream fix.
  • For Debian systems, review the referenced Debian LTS advisories.
  • If updates are unavailable, follow distribution or kernel vendor guidance.
  • Restrict unnecessary access to Wi-Fi monitor-interface management where operationally feasible.

Validation and detection

  • Inventory Linux kernels on systems with Wi-Fi hardware or wireless modules.
  • Compare installed kernel versions against vendor advisories and fixed stable releases.
  • Confirm the relevant upstream stable commit is present or backported.
  • Prioritize validation on systems allowing userspace wireless interface configuration.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21909 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux66f7ac50ed7cc5c19a62bc97e8f6e7891004a03a, 66f7ac50ed7cc5c19a62bc97e8f6e7891004a03a, 66f7ac50ed7cc5c19a62bc97e8f6e7891004a03a, 66f7ac50ed7cc5c19a62bc97e8f6e7891004a03a, 66f7ac50ed7cc5c19a62bc97e8f6e7891004a03a, 66f7ac50ed7cc5c19a62bc97e8f6e7891004a03a, 66f7ac50ed7cc5c19a62bc97e8f6e7891004a03a, 66f7ac50ed7cc5c19a62bc97e8f6e7891004a03aunaffected
LinuxLinux2.6.26, 0, 5.4.291, 5.10.235, 5.15.179, 6.1.131, 6.6.83, 6.12.19, 6.13.7, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.