Skip to main content

Linux Kernel CVE-2025-68182

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Adjacent WiFi range (AV:A) and timing-dependent link-removal race (AC:H) with no auth (PR:N); demonstrated impact is a DoS crash (A:H), while confidentiality/integrity impact is unproven (C:N/I:N).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:27 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()

This code frees "link" by calling kfree_rcu(link, rcu_head) and then it dereferences "link" to get the "link->fw_id". Save the "link->fw_id" first to avoid a potential use after free.

AnalysisAI

Memory corruption (use-after-free) in the Linux kernel's Intel iwlwifi wireless driver, specifically in iwl_mld_remove_link(), where the code frees the 'link' object via kfree_rcu() and then dereferences it to read link->fw_id. On systems with Intel WiFi hardware using the newer MLD (multi-link device) code path, a triggered link-removal race can access freed memory, most likely crashing the kernel (denial of service) with only a theoretical path to further corruption. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS probability is low (0.16%, 6th percentile).

Technical ContextAI

The flaw lives in Intel's iwlwifi driver, the mainline Linux driver for Intel wireless chipsets, within the mld (multi-link device) subsystem that supports 802.11be/WiFi 7 multi-link operation. The root cause is a classic use-after-free (CWE-416, though the input lists CWE as N/A): iwl_mld_remove_link() schedules the 'link' structure for reclamation with kfree_rcu(link, rcu_head) and then dereferences that same pointer to read link->fw_id. Because kfree_rcu queues the object for freeing, any subsequent field access is a use-after-free; the upstream fix caches link->fw_id in a local variable before the free. This executes in kernel space in the WiFi control/link-management path rather than the normal data path.

Affected ProductsAI

The affected product is the Linux kernel's Intel iwlwifi wireless driver, specifically builds that include the iwl_mld (multi-link device) code containing iwl_mld_remove_link(). Exact vulnerable and fixed kernel version ranges are not provided in the input; the two git.kernel.org/stable references (commits 5b4a239c9f94e1606435f1842fc6fd426d607dbb and 77e67d5daaf155f7d0f99f4e797c4842169ec19e) show the fix was applied to mainline and at least one stable tree, but no tagged release version is supplied. In practice this affects Linux systems running Intel WiFi hardware on kernels new enough to include the MLD/WiFi 7 driver support; distribution advisories were not included in the provided data.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update containing commits 5b4a239c9f94e1606435f1842fc6fd426d607dbb and 77e67d5daaf155f7d0f99f4e797c4842169ec19e (https://git.kernel.org/stable/c/5b4a239c9f94e1606435f1842fc6fd426d607dbb and https://git.kernel.org/stable/c/77e67d5daaf155f7d0f99f4e797c4842169ec19e), or the corresponding fixed package from your distribution once released. Until the patched kernel is deployed, compensating controls are limited because the trigger is in the WiFi driver: on hosts that do not need Intel wireless, unloading or blacklisting the iwlmld/iwlwifi module (or disabling the WiFi radio) removes the vulnerable code path at the cost of losing wireless connectivity; where WiFi is required, limit exposure to untrusted adjacent networks and avoid joining unknown SSIDs, since the attacker must be within radio range. Given low EPSS and no known exploitation, scheduled patching rather than emergency mitigation is reasonable.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68182 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy