In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: reject cooked mode if it is set along with other flags
It is possible to set both MONITORFLAGCOOKFRAMES and MONITORFLAGACTIVE flags simultaneously on the same monitor interface from the userspace. This causes a sub-interface to be created with no IEEE80211SDATAINDRIVER bit set because the monitor interface is in the cooked state and it takes precedence over all other states. When the interface is then being deleted the kernel calls WARNONCE() from checksdataindriver() because of missing that bit.
Fix this by rejecting MONITORFLAGCOOK_FRAMES if it is set along with other flags.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
[
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac4860141300581d3e2f6c6dafa37220f7ea9f65",
"digest": {
"line_hashes": [
"44993874305372621089485385261182035129",
"19742103019641599649036714428667053955",
"76575238594827506165235018239567228198"
],
"threshold": 0.9
},
"id": "CVE-2025-21909-0aa98a96",
"signature_version": "v1",
"target": {
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49f27f29446a5bfe633dd2cc0cfebd48a1a5e77f",
"digest": {
"length": 409.0,
"function_hash": "183748616560883404943086578160599127367"
},
"id": "CVE-2025-21909-0b8a5336",
"signature_version": "v1",
"target": {
"function": "parse_monitor_flags",
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@521e55c2b0d6028861ac0a2d06aa57bb0e3ac486",
"digest": {
"line_hashes": [
"44993874305372621089485385261182035129",
"19742103019641599649036714428667053955",
"76575238594827506165235018239567228198"
],
"threshold": 0.9
},
"id": "CVE-2025-21909-0eecf1b2",
"signature_version": "v1",
"target": {
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@351eb7ac53ff1cd94d893c0c4534ced2f36ae7d7",
"digest": {
"line_hashes": [
"44993874305372621089485385261182035129",
"19742103019641599649036714428667053955",
"76575238594827506165235018239567228198"
],
"threshold": 0.9
},
"id": "CVE-2025-21909-1ed15232",
"signature_version": "v1",
"target": {
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ea856d93794c4afa5542defd8c61f2708dc245a",
"digest": {
"line_hashes": [
"44993874305372621089485385261182035129",
"19742103019641599649036714428667053955",
"76575238594827506165235018239567228198"
],
"threshold": 0.9
},
"id": "CVE-2025-21909-2da78108",
"signature_version": "v1",
"target": {
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@236f41ca728f23210b31ed2d1d8a6df575a4b2d6",
"digest": {
"line_hashes": [
"44993874305372621089485385261182035129",
"19742103019641599649036714428667053955",
"76575238594827506165235018239567228198"
],
"threshold": 0.9
},
"id": "CVE-2025-21909-2f6d229e",
"signature_version": "v1",
"target": {
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd1bdcb77fdc03c253137e55bae10551b3481461",
"digest": {
"line_hashes": [
"44993874305372621089485385261182035129",
"19742103019641599649036714428667053955",
"76575238594827506165235018239567228198"
],
"threshold": 0.9
},
"id": "CVE-2025-21909-3f031e13",
"signature_version": "v1",
"target": {
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49f27f29446a5bfe633dd2cc0cfebd48a1a5e77f",
"digest": {
"line_hashes": [
"44993874305372621089485385261182035129",
"19742103019641599649036714428667053955",
"76575238594827506165235018239567228198"
],
"threshold": 0.9
},
"id": "CVE-2025-21909-5ed8194c",
"signature_version": "v1",
"target": {
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ea856d93794c4afa5542defd8c61f2708dc245a",
"digest": {
"length": 409.0,
"function_hash": "183748616560883404943086578160599127367"
},
"id": "CVE-2025-21909-7f39e133",
"signature_version": "v1",
"target": {
"function": "parse_monitor_flags",
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@521e55c2b0d6028861ac0a2d06aa57bb0e3ac486",
"digest": {
"length": 409.0,
"function_hash": "183748616560883404943086578160599127367"
},
"id": "CVE-2025-21909-8d942410",
"signature_version": "v1",
"target": {
"function": "parse_monitor_flags",
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac4860141300581d3e2f6c6dafa37220f7ea9f65",
"digest": {
"length": 409.0,
"function_hash": "183748616560883404943086578160599127367"
},
"id": "CVE-2025-21909-b5921bdd",
"signature_version": "v1",
"target": {
"function": "parse_monitor_flags",
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebebbb0eded2ed9a1abfa31962f6fb699e6abce7",
"digest": {
"length": 409.0,
"function_hash": "183748616560883404943086578160599127367"
},
"id": "CVE-2025-21909-d2855946",
"signature_version": "v1",
"target": {
"function": "parse_monitor_flags",
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@351eb7ac53ff1cd94d893c0c4534ced2f36ae7d7",
"digest": {
"length": 409.0,
"function_hash": "183748616560883404943086578160599127367"
},
"id": "CVE-2025-21909-dc52172a",
"signature_version": "v1",
"target": {
"function": "parse_monitor_flags",
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@236f41ca728f23210b31ed2d1d8a6df575a4b2d6",
"digest": {
"length": 409.0,
"function_hash": "183748616560883404943086578160599127367"
},
"id": "CVE-2025-21909-e545fd36",
"signature_version": "v1",
"target": {
"function": "parse_monitor_flags",
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd1bdcb77fdc03c253137e55bae10551b3481461",
"digest": {
"length": 409.0,
"function_hash": "183748616560883404943086578160599127367"
},
"id": "CVE-2025-21909-ec33adcb",
"signature_version": "v1",
"target": {
"function": "parse_monitor_flags",
"file": "net/wireless/nl80211.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebebbb0eded2ed9a1abfa31962f6fb699e6abce7",
"digest": {
"line_hashes": [
"44993874305372621089485385261182035129",
"19742103019641599649036714428667053955",
"76575238594827506165235018239567228198"
],
"threshold": 0.9
},
"id": "CVE-2025-21909-eddb3c7a",
"signature_version": "v1",
"target": {
"file": "net/wireless/nl80211.c"
}
}
]