CVE-2025-23155 (GCVE-0-2025-23155)

Vulnerability from cvelistv5 – Published: 2025-05-01 12:55 – Updated: 2026-05-11 21:14
VLAI
Title
net: stmmac: Fix accessing freed irq affinity_hint
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix accessing freed irq affinity_hint In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(). This value is stored in irq_desc->affinity_hint, but once stmmac_request_irq_multi_msi() returns, the pointer becomes dangling. The affinity_hint is exposed via procfs with S_IRUGO permissions, allowing any unprivileged process to read it. Accessing this stale pointer can lead to: - a kernel oops or panic if the referenced memory has been released and unmapped, or - leakage of kernel data into userspace if the memory is re-used for other purposes. All platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are affected.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8deec94c6040bb4a767f6e9456a0a44c7f2e713e , < 2fbf67ddb8a0d0efc00d2df496a9843ec318d48b (git)
Affected: 8deec94c6040bb4a767f6e9456a0a44c7f2e713e , < 960dab23f6d405740c537d095f90a4ee9ddd9285 (git)
Affected: 8deec94c6040bb4a767f6e9456a0a44c7f2e713e , < 442312c2a90d60c7a5197246583fa91d9e579985 (git)
Affected: 8deec94c6040bb4a767f6e9456a0a44c7f2e713e , < e148266e104fce396ad624079a6812ac3a9982ef (git)
Affected: 8deec94c6040bb4a767f6e9456a0a44c7f2e713e , < 9e51a6a44e2c4de780a26e8fe110d708e806a8cd (git)
Affected: 8deec94c6040bb4a767f6e9456a0a44c7f2e713e , < c60d101a226f18e9a8f01bb4c6ca2b47dfcb15ef (git)
Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 6.1.164 , ≤ 6.1.* (semver)
Unaffected: 6.6.117 , ≤ 6.6.* (semver)
Unaffected: 6.12.36 , ≤ 6.12.* (semver)
Unaffected: 6.13.12 , ≤ 6.13.* (semver)
Unaffected: 6.14.3 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2fbf67ddb8a0d0efc00d2df496a9843ec318d48b",
              "status": "affected",
              "version": "8deec94c6040bb4a767f6e9456a0a44c7f2e713e",
              "versionType": "git"
            },
            {
              "lessThan": "960dab23f6d405740c537d095f90a4ee9ddd9285",
              "status": "affected",
              "version": "8deec94c6040bb4a767f6e9456a0a44c7f2e713e",
              "versionType": "git"
            },
            {
              "lessThan": "442312c2a90d60c7a5197246583fa91d9e579985",
              "status": "affected",
              "version": "8deec94c6040bb4a767f6e9456a0a44c7f2e713e",
              "versionType": "git"
            },
            {
              "lessThan": "e148266e104fce396ad624079a6812ac3a9982ef",
              "status": "affected",
              "version": "8deec94c6040bb4a767f6e9456a0a44c7f2e713e",
              "versionType": "git"
            },
            {
              "lessThan": "9e51a6a44e2c4de780a26e8fe110d708e806a8cd",
              "status": "affected",
              "version": "8deec94c6040bb4a767f6e9456a0a44c7f2e713e",
              "versionType": "git"
            },
            {
              "lessThan": "c60d101a226f18e9a8f01bb4c6ca2b47dfcb15ef",
              "status": "affected",
              "version": "8deec94c6040bb4a767f6e9456a0a44c7f2e713e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.36",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.12",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.3",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Fix accessing freed irq affinity_hint\n\nIn stmmac_request_irq_multi_msi(), a pointer to the stack variable\ncpu_mask is passed to irq_set_affinity_hint(). This value is stored in\nirq_desc-\u003eaffinity_hint, but once stmmac_request_irq_multi_msi()\nreturns, the pointer becomes dangling.\n\nThe affinity_hint is exposed via procfs with S_IRUGO permissions,\nallowing any unprivileged process to read it. Accessing this stale\npointer can lead to:\n\n- a kernel oops or panic if the referenced memory has been released and\n  unmapped, or\n- leakage of kernel data into userspace if the memory is re-used for\n  other purposes.\n\nAll platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are\naffected."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:14:00.995Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2fbf67ddb8a0d0efc00d2df496a9843ec318d48b"
        },
        {
          "url": "https://git.kernel.org/stable/c/960dab23f6d405740c537d095f90a4ee9ddd9285"
        },
        {
          "url": "https://git.kernel.org/stable/c/442312c2a90d60c7a5197246583fa91d9e579985"
        },
        {
          "url": "https://git.kernel.org/stable/c/e148266e104fce396ad624079a6812ac3a9982ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e51a6a44e2c4de780a26e8fe110d708e806a8cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c60d101a226f18e9a8f01bb4c6ca2b47dfcb15ef"
        }
      ],
      "title": "net: stmmac: Fix accessing freed irq affinity_hint",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-23155",
    "datePublished": "2025-05-01T12:55:41.607Z",
    "dateReserved": "2025-01-11T14:28:41.514Z",
    "dateUpdated": "2026-05-11T21:14:00.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-23155",
      "date": "2026-05-25",
      "epss": "0.00107",
      "percentile": "0.28311"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-23155\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T13:15:51.413\",\"lastModified\":\"2026-03-17T14:41:48.430\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: stmmac: Fix accessing freed irq affinity_hint\\n\\nIn stmmac_request_irq_multi_msi(), a pointer to the stack variable\\ncpu_mask is passed to irq_set_affinity_hint(). This value is stored in\\nirq_desc-\u003eaffinity_hint, but once stmmac_request_irq_multi_msi()\\nreturns, the pointer becomes dangling.\\n\\nThe affinity_hint is exposed via procfs with S_IRUGO permissions,\\nallowing any unprivileged process to read it. Accessing this stale\\npointer can lead to:\\n\\n- a kernel oops or panic if the referenced memory has been released and\\n  unmapped, or\\n- leakage of kernel data into userspace if the memory is re-used for\\n  other purposes.\\n\\nAll platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are\\naffected.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: stmmac: Se corrige el acceso a la IRQ liberada affinity_hint. La m\u00e1scara cpu no debe ser una variable local, ya que su puntero se guarda en irq_desc y se puede acceder desde procfs. Para corregirla, utilice la m\u00e1scara persistente cpumask_of(cpu#).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"6.12.36\",\"matchCriteriaId\":\"573B9A24-9753-4B70-B2CD-DC8874B067AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.12\",\"matchCriteriaId\":\"4A475784-BF3B-4514-81EE-49C8522FB24A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.3\",\"matchCriteriaId\":\"483E2E15-2135-4EC6-AB64-16282C5EF704\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2fbf67ddb8a0d0efc00d2df496a9843ec318d48b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/442312c2a90d60c7a5197246583fa91d9e579985\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/960dab23f6d405740c537d095f90a4ee9ddd9285\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e51a6a44e2c4de780a26e8fe110d708e806a8cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c60d101a226f18e9a8f01bb4c6ca2b47dfcb15ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e148266e104fce396ad624079a6812ac3a9982ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.