The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() There is a bug observed when     rtw89_core_tx_kick_off_and_wait() tries to access already freed skb_data: BUG: KFENCE: use-after-free     write in rtw89_core_tx_kick_off_and_wait drivers/net/wireless/realtek/rtw89/core.c:1110 CPU: 6 UID: 0 PID:
    41377 Comm: kworker/u64:24 Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: QEMU Standard PC     (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025 Workqueue: events_unbound cfg80211_wiphy_work     [cfg80211] Use-after-free write at 0x0000000020309d9d (in kfence-#251): rtw89_core_tx_kick_off_and_wait     drivers/net/wireless/realtek/rtw89/core.c:1110 rtw89_core_scan_complete     drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb     drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb     drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed     drivers/net/wireless/realtek/rtw89/chan.h:141 rtw89_hw_scan_complete     drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp     drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work     drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread     kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154     ret_from_fork_asm arch/x86/entry/entry_64.S:258 kfence-#251: 0x0000000056e2393d-0x000000009943cb62,     size=232, cache=skbuff_head_cache allocated by task 41377 on cpu 6 at 77869.159548s (0.009551s ago):
    __alloc_skb net/core/skbuff.c:659 __netdev_alloc_skb net/core/skbuff.c:734 ieee80211_nullfunc_get     net/mac80211/tx.c:5844 rtw89_core_send_nullfunc drivers/net/wireless/realtek/rtw89/core.c:3431     rtw89_core_scan_complete drivers/net/wireless/realtek/rtw89/core.c:5338 rtw89_hw_scan_complete_cb     drivers/net/wireless/realtek/rtw89/fw.c:7979 rtw89_chanctx_proceed_cb     drivers/net/wireless/realtek/rtw89/chan.c:3165 rtw89_chanctx_proceed     drivers/net/wireless/realtek/rtw89/chan.c:3194 rtw89_hw_scan_complete     drivers/net/wireless/realtek/rtw89/fw.c:8012 rtw89_mac_c2h_scanofld_rsp     drivers/net/wireless/realtek/rtw89/mac.c:5059 rtw89_fw_c2h_work     drivers/net/wireless/realtek/rtw89/fw.c:6758 process_one_work kernel/workqueue.c:3241 worker_thread     kernel/workqueue.c:3400 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154     ret_from_fork_asm arch/x86/entry/entry_64.S:258 freed by task 1045 on cpu 9 at 77869.168393s (0.001557s     ago): ieee80211_tx_status_skb net/mac80211/status.c:1117 rtw89_pci_release_txwd_skb     drivers/net/wireless/realtek/rtw89/pci.c:564 rtw89_pci_release_tx_skbs.isra.0     drivers/net/wireless/realtek/rtw89/pci.c:651 rtw89_pci_release_tx     drivers/net/wireless/realtek/rtw89/pci.c:676 rtw89_pci_napi_poll     drivers/net/wireless/realtek/rtw89/pci.c:4238 __napi_poll net/core/dev.c:7495 net_rx_action     net/core/dev.c:7557 net/core/dev.c:7684 handle_softirqs kernel/softirq.c:580 do_softirq.part.0     kernel/softirq.c:480 __local_bh_enable_ip kernel/softirq.c:407 rtw89_pci_interrupt_threadfn     drivers/net/wireless/realtek/rtw89/pci.c:927 irq_thread_fn kernel/irq/manage.c:1133 irq_thread     kernel/irq/manage.c:1257 kthread kernel/kthread.c:463 ret_from_fork arch/x86/kernel/process.c:154     ret_from_fork_asm arch/x86/entry/entry_64.S:258 It is a consequence of a race between the waiting and the     signaling side of the completion: Waiting thread Completing thread rtw89_core_tx_kick_off_and_wait()     rcu_assign_pointer(skb_data->wait, wait) /* start waiting */ wait_for_completion_timeout()     rtw89_pci_tx_status() rtw89_core_tx_wait_complete() rcu_read_lock() /* signals completion and
    ---truncated--- (CVE-2025-40000)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-40000

medium Nessus Plugin ID 271551

Version 1.3

Version 1.1

Version 1.3 Nov 26, 2025, 1:15 PM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSSv2 severity (based on CVE-2025-40000, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202511261315
Version 1.1 Oct 27, 2025, 6:34 AM New Plugin Feed: 202510270634