CVE-2025-21909

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: nl80211: reject cooked mode if it is set along with other flags<br /> <br /> It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE<br /> flags simultaneously on the same monitor interface from the userspace. This<br /> causes a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit<br /> set because the monitor interface is in the cooked state and it takes<br /> precedence over all other states. When the interface is then being deleted<br /> the kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing<br /> that bit.<br /> <br /> Fix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with<br /> other flags.<br /> <br /> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.