CVE-2025-21930 wifi: iwlwifi: mvm: don't try to talk to a dead firmware
A local attacker can trigger a kernel warning and potential crash by interacting with debugfs when the Intel WiFi firmware is dead.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21930?
CVE-2025-21930 is a medium-severity vulnerability in Linux kernel, published on 1 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't try to talk to a dead firmware
This fixes:
bad state = 0 WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwl_trans_send_cmd+0xba/0xe0 [iwlwifi] Call Trace: <TASK> ? __warn+0xca/0x1c0 ? iwl_trans_send_cmd+0xba/0xe0 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4] iwl_fw_dbg_clear_monitor_buf+0xd7/0x110 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4] _iwl_dbgfs_fw_dbg_clear_write+0xe2/0x120 [iwlmvm 0e8adb18cea92d2c341766bcc10b18699290068a]
Ask whether the firmware is alive before sending a command.
Which versions are affected by CVE-2025-21930?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21930?
Apply the vendor's patch.
Is CVE-2025-21930 being exploited?
There is no known exploitation of CVE-2025-21930 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21930, DEBIAN-CVE-2025-21930, GHSA-pm2v-rvr8-mpff, ROOT-OS-UBUNTU-2404-CVE-2025-21930, UBUNTU-CVE-2025-21930.