Critical Race Condition in Linux Package Leading to Null Pointer Dereference
Summary
DEBIAN-CVE-2025-21729: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential functionalities for system operations, including process management, memory management, and device control. This package is crucial for the stability and performance of the operating system, making it a prime target for vulnerabilities that could compromise system integrity.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2025-21729 arises from a race condition in the Linux kernel's Wi-Fi driver (rtw89). The issue occurs when the rtwdev->scanning flag is not adequately protected by a mutex, allowing the cancel_hw_scan function to proceed while the hw_scan completion can unexpectedly unset the flag. This leads to a null pointer dereference and a use-after-free scenario, potentially causing system crashes or instability. The vulnerability can be exploited by an attacker with access to the system, leading to severe consequences such as denial of service or unauthorized access.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The vulnerability DEBIAN-CVE-2025-21729 in the Linux package poses significant risks due to a race condition that can lead to null pointer dereference. Users are strongly encouraged to update to the patched version 6.12.13-1 to mitigate these risks. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
It is a vulnerability in the Linux kernel related to a race condition that can lead to null pointer dereference and system instability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to system crashes, denial of service, or unauthorized access to system resources.
Yes, a patch is available in version 6.12.13-1 of the Linux package. Users should update to this version or later.
While there are no specific workarounds, it is advisable to monitor your system for unusual activity and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
