CVE-2025-21906

A flaw was found in the Linux kernel's Intel Wi-Fi driver (iwlwifi). A local user can cause a Denial of Service (DoS) by triggering wireless operations that encounter a firmware failure during session protection. Because the driver does not properly record state during this failure, remain-on-channel (ROC) session cleanup is skipped, leaving the link in an active state. Subsequent channel activation attempts encounter this uncleared state, triggering kernel warnings and disrupting wireless connectivity.

This vulnerability is rated as Low severity because exploitation requires local access, is restricted to systems equipped with Intel wireless adapters, and only causes a kernel warning and temporary loss of Wi-Fi connectivity rather than system compromise. Enterprise server deployments typically do not utilize Wi-Fi interfaces or load the relevant wireless drivers, significantly limiting exposure in standard environments. Under affected configurations, the flaw manifests only when session protection encounters an internal firmware error, preventing wider system disruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.