Security readout for executives and security teams
Plain-English summary
A race condition in the Linux rtw89 Realtek Wi-Fi driver can write to memory after it has been freed. Affected systems may crash or suffer memory corruption during wireless operations. The supplied CVSS score is 8.8, but the bundle does not establish real-world exploitation.
Executive priority
Treat as a high-priority endpoint and appliance patching issue where rtw89 is present. Accelerate validation and remediation for exposed wireless systems, while avoiding an estate-wide emergency designation until hardware, driver, and kernel applicability are confirmed.
Technical view
The flaw is a use-after-free write in rtw89_core_tx_kick_off_and_wait(). The waiting path retains a pointer associated with an SKB while the PCI transmit-completion path can signal completion and free that SKB concurrently. The supplied trace observes the race during scan completion. Kernel stable commits are referenced as fixes.
Likely exposure
Exposure is limited to Linux systems using affected kernel versions with supported Realtek Wi-Fi hardware and the rtw89 driver active. Systems without that driver or hardware are unlikely to be exposed. The supplied affected-version data is ambiguous, so distribution-specific advisories should determine exact applicability.
Exploitation context
The supplied CVSS vector rates attack proximity as adjacent, with no privileges or user interaction required and potentially high confidentiality, integrity, and availability impact. However, the bundle provides no exploit demonstration or evidence of active exploitation, and the CVE is not listed as KEV.
Researcher notes
The evidence identifies a completion-signaling race between a worker waiting on transmitted SKB data and the PCI/NAPI path releasing that SKB. KFENCE recorded a use-after-free write. Exact vulnerable-version boundaries and practical exploitability cannot be resolved confidently from the truncated description and unusual version data alone.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Check Linux distribution advisories for exact affected and corrected package versions.
- Prioritize laptops, workstations, and appliances using Realtek Wi-Fi with rtw89.
- If immediate patching is impossible, consider disabling affected wireless hardware where operationally acceptable.
Validation and detection
- Inventory kernel versions and systems using the rtw89 driver.
- Confirm installed Wi-Fi hardware relies on the affected Realtek driver.
- Compare kernel packages against distribution advisories and referenced stable commits.
- After updating, verify the corrected kernel is running following reboot.
- Monitor kernel logs for rtw89 crashes, KFENCE reports, or memory-corruption symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40000 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/895cccf639ac015f3d5f993218cf098db82ac145CVE reference, Linux
- https://git.kernel.org/stable/c/f21f530b03b4b23448edb531a0cfea434cb76bb4CVE reference, Linux
- https://git.kernel.org/stable/c/bdb3c41b358cf87d99e39d393e164f9e4a6088e6CVE reference, Linux
- https://git.kernel.org/stable/c/3e31a6bc07312b448fad3b45de578471f86f0e77CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.