UBUNTU-CVE-2025-71297: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: 8822b: Avoid WARNING in rtw8822bconfigtrxmode() rtw8822bsetantenna() can be called from userspace when the chip is powered off. In that case a WARNING is triggered in rtw8822bconfigtrxmode() because trying to read the RF registers when the chip is powered off returns an unexpected value. Call rtw8822bconfigtrxmode() in rtw8822bsetantenna() only when the chip is powered on. ------------[ cut here ]------------ write RF mode table fail WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822bconfigtrxmode.constprop.0+0x835/0x840 [rtw888822b] CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1 Tainted: [W]=WARN, [O]=OOTMODULE, [E]=UNSIGNEDMODULE Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021 RIP: 0010:rtw8822bconfigtrxmode.constprop.0+0x835/0x840 [rtw888822b] Call Trace: <TASK> rtw8822bsetantenna+0x57/0x70 [rtw888822b 370206f42e5890d8d5f48eb358b759efa37c422b] rtwopssetantenna+0x50/0x80 [rtw88core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb] ieee80211setantenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3] nl80211setwiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] ? netdevruntodo+0x63/0x550 genlfamilyrcvmsgdoit+0xfc/0x160 genlrcvmsg+0x1aa/0x2b0 ? pfxnl80211predoit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] ? pfxnl80211setwiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] ? pfxnl80211postdoit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda] ? pfxgenlrcvmsg+0x10/0x10 netlinkrcvskb+0x59/0x110 genlrcv+0x28/0x40 netlinkunicast+0x285/0x3c0 ? allocskb+0xdb/0x1a0 netlinksendmsg+0x20d/0x430 syssendmsg+0x39f/0x3d0 ? importiovec+0x2f/0x40 syssendmsg+0x99/0xe0 ? refillobjstock+0x12e/0x240 syssendmsg+0x8a/0xf0 dosyscall64+0x81/0x970 ? dosyscall64+0x81/0x970 ? ksysread+0x73/0xf0 ? dosyscall64+0x81/0x970 ? countmemcgevents+0xc2/0x190 ? handlemmfault+0x1d7/0x2d0 ? douseraddrfault+0x21a/0x690 ? excpagefault+0x7e/0x1a0 entrySYSCALL64afterhwframe+0x76/0x7e </TASK> ---[ end trace 0000000000000000 ]---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1062.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1055.56~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-134.134 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1045.48 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1060.61 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1029.30 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1060.64 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1026.30 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2049.50 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1055.56 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-134.134+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69+fips1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the rtw88 8822B Wi-Fi chipset and driver are exposed when antenna configuration can be requested while that chip is powered off. The listed affected Ubuntu kernel package families include linux, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-riscv, linux-gke, and linux-gkeop.
What access does an attacker need to trigger the problem?
The vulnerability has local attack vector and requires high privileges, with no user interaction required. The trigger involves a userspace request that reaches the driver's antenna-setting operation while the Wi-Fi chip is powered off.
What is the observed impact?
The vulnerable path produces a kernel WARNING when the driver attempts to read RF registers from a powered-off chip and receives an unexpected value. The supplied severity vector indicates availability impact but no confidentiality or integrity impact.
How can I identify a likely occurrence?
Check kernel logs for the "write RF mode table fail" warning and a stack trace involving rtw8822b_config_trx_mode(), rtw8822b_set_antenna(), and the rtw88_8822b module. The warning may occur when an antenna-setting request is made while the 8822B hardware is powered off.