CVE-2025-21828

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: don't flush non-uploaded STAs

If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never knew about the station, so trying to flush it is unexpected and may crash.

Check if the sta was uploaded to the driver before and fix this.

This vulnerability is rated as Moderate severity because it requires local privileges or control over wireless network setup to trigger an unexpected kernel crash, resulting solely in a denial of service without compromising system confidentiality or integrity. The issue resides in the kernel mac80211 subsystem handling station cleanup during failed insertion in ad-hoc (IBSS) configurations. Typical Red Hat Enterprise Linux server deployments do not utilize Wi-Fi interfaces or ad-hoc wireless modes, substantially reducing exposure under standard operational conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.