CVE-2025-21934

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21934
In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rio_add_net() fails rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "mport->net = NULL;" to avoid a use after free issue.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/22e4977141dfc6d109bf29b495bf2187b4250990 Patch
https://git.kernel.org/stable/c/2537f01d57f08c527e40bbb5862aa6ff43344898 Patch
https://git.kernel.org/stable/c/88ddad53e4cfb6de861c6d4fb7b25427f46baed5 Patch
https://git.kernel.org/stable/c/a5f5e520e8fbc6294020ff8afa36f684d92c6e6a Patch
https://git.kernel.org/stable/c/b2ef51c74b0171fde7eb69b6152d3d2f743ef269 Patch
https://git.kernel.org/stable/c/cdd9f58f7fe41a55fae4305ea51fc234769fd466 Patch
https://git.kernel.org/stable/c/d4ec862ce80f64db923a1d942b5d11cf6fc87d36 Patch
https://git.kernel.org/stable/c/f0aa4ee1cbbf7789907e5a3f6810de01c146c211 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
History

10 Apr 2025, 18:06

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/22e4977141dfc6d109bf29b495bf2187b4250990 - () https://git.kernel.org/stable/c/22e4977141dfc6d109bf29b495bf2187b4250990 - Patch
References () https://git.kernel.org/stable/c/2537f01d57f08c527e40bbb5862aa6ff43344898 - () https://git.kernel.org/stable/c/2537f01d57f08c527e40bbb5862aa6ff43344898 - Patch
References () https://git.kernel.org/stable/c/88ddad53e4cfb6de861c6d4fb7b25427f46baed5 - () https://git.kernel.org/stable/c/88ddad53e4cfb6de861c6d4fb7b25427f46baed5 - Patch
References () https://git.kernel.org/stable/c/a5f5e520e8fbc6294020ff8afa36f684d92c6e6a - () https://git.kernel.org/stable/c/a5f5e520e8fbc6294020ff8afa36f684d92c6e6a - Patch
References () https://git.kernel.org/stable/c/b2ef51c74b0171fde7eb69b6152d3d2f743ef269 - () https://git.kernel.org/stable/c/b2ef51c74b0171fde7eb69b6152d3d2f743ef269 - Patch
References () https://git.kernel.org/stable/c/cdd9f58f7fe41a55fae4305ea51fc234769fd466 - () https://git.kernel.org/stable/c/cdd9f58f7fe41a55fae4305ea51fc234769fd466 - Patch
References () https://git.kernel.org/stable/c/d4ec862ce80f64db923a1d942b5d11cf6fc87d36 - () https://git.kernel.org/stable/c/d4ec862ce80f64db923a1d942b5d11cf6fc87d36 - Patch
References () https://git.kernel.org/stable/c/f0aa4ee1cbbf7789907e5a3f6810de01c146c211 - () https://git.kernel.org/stable/c/f0aa4ee1cbbf7789907e5a3f6810de01c146c211 - Patch
CWE CWE-416
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rapidio: se corrige un error de API cuando rio_add_net() falla. rio_add_net() llama a device_register() y falla cuando device_register() falla. Por lo tanto, se debe usar put_device() en lugar de kfree(). Se agregó "mport->net = NULL;" para evitar un problema de use-after-free.
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*

01 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 16:15

Updated : 2025-04-10 18:06

NVD link : CVE-2025-21934

Mitre link : CVE-2025-21934

CVE.ORG link : CVE-2025-21934

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free