{"id":"CVE-2025-21906","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: clean up ROC on failure\n\nIf the firmware fails to start the session protection, then we\ndo call iwl_mvm_roc_finished() here, but that won't do anyth…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: clean up ROC on failure\n\nIf the firmware fails to start the session protection, then we\ndo call iwl_mvm_roc_finished() here, but that won't do anyth…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cwe":["CWE-665"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.9, < 6.12.19","linux_kernel >= 6.13, < 6.13.7","linux_kernel = 6.14"],"patched":["linux_kernel 6.13.7"],"published":"2025-04-01","updated":"2026-07-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-21906","references":[{"url":"https://git.kernel.org/stable/c/a88c18409b5d69f426d5acc583c053eac71756a3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1a12fcb9051bbf38b2e5af310ffb102a0fab6f9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9751163bffd3fe60794929829f810968c6de73d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00218,"epssPercentile":0.12568,"ingestedAt":"2026-07-30T06:53:10.913Z","slug":"CVE-2025-21906","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: clean up ROC on failure\n\nIf the firmware fails to start the session protection, then we\ndo call iwl_mvm_roc_finished() here, but that won't do anything\nat all because IWL_MVM_STATUS_ROC_P2P_RUNNING was never set.\nSet IWL_MVM_STATUS_ROC_P2P_RUNNING in the failure/stop path.\nIf it started successfully before, it's already set, so that\ndoesn't matter, and if it didn't start it needs to be set to\nclean up.\n\nNot doing so will lead to a WARN_ON() later on a fresh remain-\non-channel, since the link is already active when activated as\nit was never deactivated.\n\n## Affected\n\n- `linux_kernel >= 6.9, < 6.12.19`\n- `linux_kernel >= 6.13, < 6.13.7`\n- `linux_kernel = 6.14`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.13.7`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}