CVE-2025-21914 (GCVE-0-2025-21914)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:40 – Updated: 2026-08-05 11:55
VLAI
Title
slimbus: messaging: Free transaction ID in delayed interrupt scenario
Summary
In the Linux kernel, the following vulnerability has been resolved: slimbus: messaging: Free transaction ID in delayed interrupt scenario In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not freed. This results into invalid memory access inside qcom_slim_ngd_rx_msgq_cb() due to invalid TID. Fix the issue by freeing the TID in slim_do_transfer() before returning timeout error to avoid invalid memory access. Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 Code: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ end trace 0fe00bec2b975c99 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: afbdcc7c384b0d446da08b1e0901dc176b41b9e0 , < cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9fe (git)
Affected: afbdcc7c384b0d446da08b1e0901dc176b41b9e0 , < a32e5198a9134772eb03f7b72a7849094c55bda9 (git)
Affected: afbdcc7c384b0d446da08b1e0901dc176b41b9e0 , < 09d34c4cbc38485c7514069f25348e439555b282 (git)
Affected: afbdcc7c384b0d446da08b1e0901dc176b41b9e0 , < 18ae4cee05c310c299ba75d7477dcf34be67aa16 (git)
Affected: afbdcc7c384b0d446da08b1e0901dc176b41b9e0 , < faac8e894014e8167471a8e4a5eb35a8fefbb82a (git)
Affected: afbdcc7c384b0d446da08b1e0901dc176b41b9e0 , < 6abf3d8bb51cbaf886c3f08109a0462890b10db6 (git)
Affected: afbdcc7c384b0d446da08b1e0901dc176b41b9e0 , < 0c541c8f6da23e0b92f0a6216d899659a7572074 (git)
Affected: afbdcc7c384b0d446da08b1e0901dc176b41b9e0 , < dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a (git)
Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.4.291 , ≤ 5.4.* (semver)
Unaffected: 5.10.235 , ≤ 5.10.* (semver)
Unaffected: 5.15.179 , ≤ 5.15.* (semver)
Unaffected: 6.1.131 , ≤ 6.1.* (semver)
Unaffected: 6.6.83 , ≤ 6.6.* (semver)
Unaffected: 6.12.19 , ≤ 6.12.* (semver)
Unaffected: 6.13.7 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:39:02.707Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/slimbus/messaging.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9fe",
              "status": "affected",
              "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0",
              "versionType": "git"
            },
            {
              "lessThan": "a32e5198a9134772eb03f7b72a7849094c55bda9",
              "status": "affected",
              "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0",
              "versionType": "git"
            },
            {
              "lessThan": "09d34c4cbc38485c7514069f25348e439555b282",
              "status": "affected",
              "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0",
              "versionType": "git"
            },
            {
              "lessThan": "18ae4cee05c310c299ba75d7477dcf34be67aa16",
              "status": "affected",
              "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0",
              "versionType": "git"
            },
            {
              "lessThan": "faac8e894014e8167471a8e4a5eb35a8fefbb82a",
              "status": "affected",
              "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0",
              "versionType": "git"
            },
            {
              "lessThan": "6abf3d8bb51cbaf886c3f08109a0462890b10db6",
              "status": "affected",
              "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0",
              "versionType": "git"
            },
            {
              "lessThan": "0c541c8f6da23e0b92f0a6216d899659a7572074",
              "status": "affected",
              "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0",
              "versionType": "git"
            },
            {
              "lessThan": "dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a",
              "status": "affected",
              "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/slimbus/messaging.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.131",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.83",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslimbus: messaging: Free transaction ID in delayed interrupt scenario\n\nIn case of interrupt delay for any reason, slim_do_transfer()\nreturns timeout error but the transaction ID (TID) is not freed.\nThis results into invalid memory access inside\nqcom_slim_ngd_rx_msgq_cb() due to invalid TID.\n\nFix the issue by freeing the TID in slim_do_transfer() before\nreturning timeout error to avoid invalid memory access.\n\nCall trace:\n__memcpy_fromio+0x20/0x190\nqcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl]\nvchan_complete+0x2a0/0x4a0\ntasklet_action_common+0x274/0x700\ntasklet_action+0x28/0x3c\n_stext+0x188/0x620\nrun_ksoftirqd+0x34/0x74\nsmpboot_thread_fn+0x1d8/0x464\nkthread+0x178/0x238\nret_from_fork+0x10/0x20\nCode: aa0003e8 91000429 f100044a 3940002b (3800150b)\n---[ end trace 0fe00bec2b975c99 ]---\nKernel panic - not syncing: Oops: Fatal exception in interrupt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - SLIMbus is an on-SoC hardware bus with no network exposure; the vulnerable transfer path is reached from local userspace through ALSA control/PCM ioctls on /dev/snd \u2192 ASoC codec (wcd9335/wcd934x) \u2192 regmap-slimbus \u2192 slim_read()/slim_write() \u2192 slim_do_transfer(). No physical device attachment is required, so this is Local rather than Physical.\nAC:L - A local attacker drives both sides of the condition \u2014 issuing many concurrent SLIMbus transactions via mixer/PCM operations while loading CPUs and softirq processing to push the 1-second TX/response completion past its timeout, after which the delayed DMA response still arrives and hits the stale IDR entry. The attacker also influences what reoccupies the freed stack frame via subsequent syscalls on the same kernel stack, so no condition is truly outside their control.\nPR:L - Only an ordinary local account with access to the sound devices is needed (audio group on desktops/embedded, the audio process on Android); there is no capability check, credential gate, or root requirement anywhere between the ioctl entry point and slim_do_transfer().\nUI:N - The attacker triggers the SLIMbus transactions and the timeout directly from their own process; no victim action, mount, or file open is required.\nS:U - The dangling-pointer dereference and resulting memory corruption occur entirely within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - slim_msg_response() dereferences a freed stack frame (txn-\u003emsg, msg-\u003erbuf, txn-\u003ecomp), reading whatever reclaimed data now occupies it, and copies controller data through that attacker-influenceable pointer; per use-after-free guidance this yields an arbitrary-read primitive and kernel memory disclosure.\nI:H - memcpy(msg-\u003erbuf, reply, len) writes response bytes to a pointer taken from reclaimed stack memory, and complete(txn-\u003ecomp) performs spinlock/list-manipulation on a second stale pointer, giving a controllable write primitive suitable for heap/stack grooming and control-flow hijack.\nA:H - The reported failure is a fatal oops inside interrupt/softirq context ending in \"Kernel panic - not syncing\", and the corruption is triggerable repeatedly; additionally the leaked TIDs exhaust the 256-entry IDR space."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:18.648Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/a32e5198a9134772eb03f7b72a7849094c55bda9"
        },
        {
          "url": "https://git.kernel.org/stable/c/09d34c4cbc38485c7514069f25348e439555b282"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ae4cee05c310c299ba75d7477dcf34be67aa16"
        },
        {
          "url": "https://git.kernel.org/stable/c/faac8e894014e8167471a8e4a5eb35a8fefbb82a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6abf3d8bb51cbaf886c3f08109a0462890b10db6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c541c8f6da23e0b92f0a6216d899659a7572074"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a"
        }
      ],
      "title": "slimbus: messaging: Free transaction ID in delayed interrupt scenario",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21914",
    "datePublished": "2025-04-01T15:40:51.437Z",
    "dateReserved": "2024-12-29T08:45:45.787Z",
    "dateUpdated": "2026-08-05T11:55:18.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21914",
      "date": "2026-08-05",
      "epss": "0.00212",
      "percentile": "0.11608"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21914\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:21.997\",\"lastModified\":\"2026-07-30T06:21:56.620\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nslimbus: messaging: Free transaction ID in delayed interrupt scenario\\n\\nIn case of interrupt delay for any reason, slim_do_transfer()\\nreturns timeout error but the transaction ID (TID) is not freed.\\nThis results into invalid memory access inside\\nqcom_slim_ngd_rx_msgq_cb() due to invalid TID.\\n\\nFix the issue by freeing the TID in slim_do_transfer() before\\nreturning timeout error to avoid invalid memory access.\\n\\nCall trace:\\n__memcpy_fromio+0x20/0x190\\nqcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl]\\nvchan_complete+0x2a0/0x4a0\\ntasklet_action_common+0x274/0x700\\ntasklet_action+0x28/0x3c\\n_stext+0x188/0x620\\nrun_ksoftirqd+0x34/0x74\\nsmpboot_thread_fn+0x1d8/0x464\\nkthread+0x178/0x238\\nret_from_fork+0x10/0x20\\nCode: aa0003e8 91000429 f100044a 3940002b (3800150b)\\n---[ end trace 0fe00bec2b975c99 ]---\\nKernel panic - not syncing: Oops: Fatal exception in interrupt.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: slimbus: mensajer\u00eda: ID de transacci\u00f3n libre en un escenario de interrupci\u00f3n retrasada. En caso de retraso en la interrupci\u00f3n por cualquier motivo, slim_do_transfer() devuelve un error de tiempo de espera, pero el ID de transacci\u00f3n (TID) no se libera. Esto provoca un acceso no v\u00e1lido a memoria dentro de qcom_slim_ngd_rx_msgq_cb() debido a un TID no v\u00e1lido. Para solucionar el problema, libere el TID en slim_do_transfer() antes de devolver el error de tiempo de espera para evitar accesos no v\u00e1lidos a memoria. Rastreo de llamadas: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 C\u00f3digo: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ fin de seguimiento 0fe00bec2b975c99 ]--- P\u00e1nico del kernel - no sincroniza: Ups: Excepci\u00f3n fatal en la interrupci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/slimbus/messaging.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"afbdcc7c384b0d446da08b1e0901dc176b41b9e0\",\"lessThan\":\"cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9fe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afbdcc7c384b0d446da08b1e0901dc176b41b9e0\",\"lessThan\":\"a32e5198a9134772eb03f7b72a7849094c55bda9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afbdcc7c384b0d446da08b1e0901dc176b41b9e0\",\"lessThan\":\"09d34c4cbc38485c7514069f25348e439555b282\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afbdcc7c384b0d446da08b1e0901dc176b41b9e0\",\"lessThan\":\"18ae4cee05c310c299ba75d7477dcf34be67aa16\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afbdcc7c384b0d446da08b1e0901dc176b41b9e0\",\"lessThan\":\"faac8e894014e8167471a8e4a5eb35a8fefbb82a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afbdcc7c384b0d446da08b1e0901dc176b41b9e0\",\"lessThan\":\"6abf3d8bb51cbaf886c3f08109a0462890b10db6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afbdcc7c384b0d446da08b1e0901dc176b41b9e0\",\"lessThan\":\"0c541c8f6da23e0b92f0a6216d899659a7572074\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"afbdcc7c384b0d446da08b1e0901dc176b41b9e0\",\"lessThan\":\"dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/slimbus/messaging.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.291\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.235\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.179\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.131\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.83\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.19\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.7\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndExcluding\":\"5.4.291\",\"matchCriteriaId\":\"1F47BFB4-6BBC-4288-B9B8-94EA74437830\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.235\",\"matchCriteriaId\":\"545121FA-DE31-4154-9446-C2000FB4104D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.179\",\"matchCriteriaId\":\"C708062C-4E1B-465F-AE6D-C09C46400875\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.131\",\"matchCriteriaId\":\"BA9C2DE3-D37C-46C6-8DCD-2EE509456E0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.83\",\"matchCriteriaId\":\"7D9F642F-6E05-4926-B0FE-62F95B7266BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.19\",\"matchCriteriaId\":\"32865E5C-8AE1-4D3D-A64D-299039694A88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.7\",\"matchCriteriaId\":\"842F5A44-3E71-4546-B4FD-43B0ACE3F32B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09d34c4cbc38485c7514069f25348e439555b282\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0c541c8f6da23e0b92f0a6216d899659a7572074\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/18ae4cee05c310c299ba75d7477dcf34be67aa16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6abf3d8bb51cbaf886c3f08109a0462890b10db6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a32e5198a9134772eb03f7b72a7849094c55bda9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/faac8e894014e8167471a8e4a5eb35a8fefbb82a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:20:32+00:00",
      "cve": "CVE-2025-21914",
      "id": "CVE-2025-21914",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: slimbus: messaging: Free transaction ID in delayed interrupt scenario",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21914.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:02:52Z",
      "cve": "CVE-2025-21914",
      "id": "CVE-2025-21914",
      "initial_release_date": "2025-04-02T08:57:31Z",
      "product_status:known_affected": "557",
      "product_status:known_not_affected": "115",
      "product_status:recommended": "395",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21914",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21914.json",
      "version": "42"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.