CVE-2025-21915 (GCVE-0-2025-21915)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:40 – Updated: 2026-08-05 11:55
VLAI
Title
cdx: Fix possible UAF error in driver_override_show()
Summary
In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs. The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users. Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues. This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2959ab247061e67485d83b6af8feb3761ec08cb9 , < d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf (git)
Affected: 2959ab247061e67485d83b6af8feb3761ec08cb9 , < 8473135f89c0949436a22adb05b8cece2fb3da91 (git)
Affected: 2959ab247061e67485d83b6af8feb3761ec08cb9 , < 0439d541aa8d3444ad41c39e39eb71acb57acde3 (git)
Affected: 2959ab247061e67485d83b6af8feb3761ec08cb9 , < 91d44c1afc61a2fec37a9c7a3485368309391e0b (git)
Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.83 , ≤ 6.6.* (semver)
Unaffected: 6.12.19 , ≤ 6.12.* (semver)
Unaffected: 6.13.7 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21915",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-21T14:57:30.156471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-21T15:01:46.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cdx/cdx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf",
              "status": "affected",
              "version": "2959ab247061e67485d83b6af8feb3761ec08cb9",
              "versionType": "git"
            },
            {
              "lessThan": "8473135f89c0949436a22adb05b8cece2fb3da91",
              "status": "affected",
              "version": "2959ab247061e67485d83b6af8feb3761ec08cb9",
              "versionType": "git"
            },
            {
              "lessThan": "0439d541aa8d3444ad41c39e39eb71acb57acde3",
              "status": "affected",
              "version": "2959ab247061e67485d83b6af8feb3761ec08cb9",
              "versionType": "git"
            },
            {
              "lessThan": "91d44c1afc61a2fec37a9c7a3485368309391e0b",
              "status": "affected",
              "version": "2959ab247061e67485d83b6af8feb3761ec08cb9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cdx/cdx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.83",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncdx: Fix possible UAF error in driver_override_show()\n\nFixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c\n\nThis function driver_override_show() is part of DEVICE_ATTR_RW, which\nincludes both driver_override_show() and driver_override_store().\nThese functions can be executed concurrently in sysfs.\n\nThe driver_override_store() function uses driver_set_override() to\nupdate the driver_override value, and driver_set_override() internally\nlocks the device (device_lock(dev)). If driver_override_show() reads\ncdx_dev-\u003edriver_override without locking, it could potentially access\na freed pointer if driver_override_store() frees the string\nconcurrently. This could lead to printing a kernel address, which is a\nsecurity risk since DEVICE_ATTR can be read by all users.\n\nAdditionally, a similar pattern is used in drivers/amba/bus.c, as well\nas many other bus drivers, where device_lock() is taken in the show\nfunction, and it has been working without issues.\n\nThis potential bug was detected by our experimental static analysis\ntool, which analyzes locking APIs and paired functions to identify\ndata races and atomicity violations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only by read(2) on the local sysfs attribute /sys/bus/cdx/devices/\u003cdev\u003e/driver_override; no network, adjacent-network, or physical vector reaches driver_override_show().\nAC:H - The dangling read is only possible in the narrow window during which a privileged writer (driver_override_store()/device teardown) frees the old string, and the attacker cannot induce that write \u2014 plus CDX_BUS is a non-default, platform-specific config (OF \u0026\u0026 ARM64, absent from arm64 defconfig).\nPR:L - The exploiting side of the race is the read, and DEVICE_ATTR_RW creates the file mode 0644, so any unprivileged local user can open and repeatedly read it \u2014 the upstream fix explicitly cites \"DEVICE_ATTR can be read by all users\" as the security risk.\nUI:N - The attacker\u0027s own read loop needs no victim action; the concurrent override write occurs during routine automated device bind/unbind (udev/orchestration) rather than requiring a user to be tricked into anything, and the timing dependency is already charged under AC:H.\nS:U - The freed memory and the leaking sysfs read are both in the kernel\u0027s own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - vsnprintf(\"%s\") walks the freed slab object until a NUL byte, so up to a full PAGE_SIZE of reallocated kernel heap \u2014 including kernel pointers and whatever objects landed in the freed kmalloc slot \u2014 is copied verbatim to any unprivileged reader, defeating KASLR and disclosing arbitrary adjacent kernel data.\nI:H - This is a CWE-416 use-after-free on a heap object whose contents the attacker can influence by spraying the freed kmalloc slot; per UAF handling the integrity impact is High, and the disclosed heap/pointer state directly enables control-flow-hijack chains against the same kernel.\nA:H - Dereferencing the freed pointer can oops \u2014 under KASAN/panic_on_warn it panics immediately, and with SLUB poisoning (no NUL in the 0x6b fill) the string walk can run off the slab page into unmapped memory, faulting in kernel context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:19.720Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/8473135f89c0949436a22adb05b8cece2fb3da91"
        },
        {
          "url": "https://git.kernel.org/stable/c/0439d541aa8d3444ad41c39e39eb71acb57acde3"
        },
        {
          "url": "https://git.kernel.org/stable/c/91d44c1afc61a2fec37a9c7a3485368309391e0b"
        }
      ],
      "title": "cdx: Fix possible UAF error in driver_override_show()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21915",
    "datePublished": "2025-04-01T15:40:52.019Z",
    "dateReserved": "2024-12-29T08:45:45.787Z",
    "dateUpdated": "2026-08-05T11:55:19.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21915",
      "date": "2026-08-05",
      "epss": "0.00194",
      "percentile": "0.09331"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21915\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:22.117\",\"lastModified\":\"2026-07-30T06:21:56.777\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncdx: Fix possible UAF error in driver_override_show()\\n\\nFixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c\\n\\nThis function driver_override_show() is part of DEVICE_ATTR_RW, which\\nincludes both driver_override_show() and driver_override_store().\\nThese functions can be executed concurrently in sysfs.\\n\\nThe driver_override_store() function uses driver_set_override() to\\nupdate the driver_override value, and driver_set_override() internally\\nlocks the device (device_lock(dev)). If driver_override_show() reads\\ncdx_dev-\u003edriver_override without locking, it could potentially access\\na freed pointer if driver_override_store() frees the string\\nconcurrently. This could lead to printing a kernel address, which is a\\nsecurity risk since DEVICE_ATTR can be read by all users.\\n\\nAdditionally, a similar pattern is used in drivers/amba/bus.c, as well\\nas many other bus drivers, where device_lock() is taken in the show\\nfunction, and it has been working without issues.\\n\\nThis potential bug was detected by our experimental static analysis\\ntool, which analyzes locking APIs and paired functions to identify\\ndata races and atomicity violations.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cdx: Se corrige un posible error de UAF en driver_override_show() Se corrigi\u00f3 un posible problema de UAF en driver_override_show() en drivers/cdx/cdx.c Esta funci\u00f3n driver_override_show() es parte de DEVICE_ATTR_RW, que incluye tanto driver_override_show() como driver_override_store(). Estas funciones se pueden ejecutar simult\u00e1neamente en sysfs. La funci\u00f3n driver_override_store() usa driver_set_override() para actualizar el valor de driver_override, y driver_set_override() bloquea internamente el dispositivo (device_lock(dev)). Si driver_override_show() lee cdx_dev-\u0026gt;driver_override sin bloquear, podr\u00eda acceder potencialmente a un puntero liberado si driver_override_store() libera la cadena simult\u00e1neamente. Esto podr\u00eda llevar a imprimir una direcci\u00f3n del kernel, lo cual es un riesgo de seguridad ya que DEVICE_ATTR puede ser le\u00eddo por todos los usuarios. Adem\u00e1s, se utiliza un patr\u00f3n similar en drivers/amba/bus.c, as\u00ed como en muchos otros controladores de bus, donde device_lock() se utiliza en la funci\u00f3n show y ha funcionado sin problemas. Este posible error fue detectado por nuestra herramienta experimental de an\u00e1lisis est\u00e1tico, que analiza las API de bloqueo y las funciones emparejadas para identificar carreras de datos y violaciones de atomicidad.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/cdx/cdx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2959ab247061e67485d83b6af8feb3761ec08cb9\",\"lessThan\":\"d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2959ab247061e67485d83b6af8feb3761ec08cb9\",\"lessThan\":\"8473135f89c0949436a22adb05b8cece2fb3da91\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2959ab247061e67485d83b6af8feb3761ec08cb9\",\"lessThan\":\"0439d541aa8d3444ad41c39e39eb71acb57acde3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2959ab247061e67485d83b6af8feb3761ec08cb9\",\"lessThan\":\"91d44c1afc61a2fec37a9c7a3485368309391e0b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/cdx/cdx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.83\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.19\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.7\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-04-21T14:57:30.156471Z\",\"id\":\"CVE-2025-21915\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.6.83\",\"matchCriteriaId\":\"26866BD1-5D49-4AB2-A736-919ECA02F0AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.19\",\"matchCriteriaId\":\"32865E5C-8AE1-4D3D-A64D-299039694A88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.7\",\"matchCriteriaId\":\"842F5A44-3E71-4546-B4FD-43B0ACE3F32B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0439d541aa8d3444ad41c39e39eb71acb57acde3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8473135f89c0949436a22adb05b8cece2fb3da91\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/91d44c1afc61a2fec37a9c7a3485368309391e0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:38:05+00:00",
      "cve": "CVE-2025-21915",
      "id": "CVE-2025-21915",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cdx: Fix possible UAF error in driver_override_show()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21915.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-03T03:53:19Z",
      "cve": "CVE-2025-21915",
      "id": "CVE-2025-21915",
      "initial_release_date": "2025-04-02T13:29:13Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "276",
      "product_status:recommended": "368",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21915",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21915.json",
      "version": "40"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21915\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-21T14:57:30.156471Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-21T14:57:31.680Z\"}}], \"cna\": {\"title\": \"cdx: Fix possible UAF error in driver_override_show()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only by read(2) on the local sysfs attribute /sys/bus/cdx/devices/\u003cdev\u003e/driver_override; no network, adjacent-network, or physical vector reaches driver_override_show().\\nAC:H - The dangling read is only possible in the narrow window during which a privileged writer (driver_override_store()/device teardown) frees the old string, and the attacker cannot induce that write \\u2014 plus CDX_BUS is a non-default, platform-specific config (OF \u0026\u0026 ARM64, absent from arm64 defconfig).\\nPR:L - The exploiting side of the race is the read, and DEVICE_ATTR_RW creates the file mode 0644, so any unprivileged local user can open and repeatedly read it \\u2014 the upstream fix explicitly cites \\\"DEVICE_ATTR can be read by all users\\\" as the security risk.\\nUI:N - The attacker\u0027s own read loop needs no victim action; the concurrent override write occurs during routine automated device bind/unbind (udev/orchestration) rather than requiring a user to be tricked into anything, and the timing dependency is already charged under AC:H.\\nS:U - The freed memory and the leaking sysfs read are both in the kernel\u0027s own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - vsnprintf(\\\"%s\\\") walks the freed slab object until a NUL byte, so up to a full PAGE_SIZE of reallocated kernel heap \\u2014 including kernel pointers and whatever objects landed in the freed kmalloc slot \\u2014 is copied verbatim to any unprivileged reader, defeating KASLR and disclosing arbitrary adjacent kernel data.\\nI:H - This is a CWE-416 use-after-free on a heap object whose contents the attacker can influence by spraying the freed kmalloc slot; per UAF handling the integrity impact is High, and the disclosed heap/pointer state directly enables control-flow-hijack chains against the same kernel.\\nA:H - Dereferencing the freed pointer can oops \\u2014 under KASAN/panic_on_warn it panics immediately, and with SLUB poisoning (no NUL in the 0x6b fill) the string walk can run off the slab page into unmapped memory, faulting in kernel context.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2959ab247061e67485d83b6af8feb3761ec08cb9\", \"lessThan\": \"d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2959ab247061e67485d83b6af8feb3761ec08cb9\", \"lessThan\": \"8473135f89c0949436a22adb05b8cece2fb3da91\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2959ab247061e67485d83b6af8feb3761ec08cb9\", \"lessThan\": \"0439d541aa8d3444ad41c39e39eb71acb57acde3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2959ab247061e67485d83b6af8feb3761ec08cb9\", \"lessThan\": \"91d44c1afc61a2fec37a9c7a3485368309391e0b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/cdx/cdx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/cdx/cdx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf\"}, {\"url\": \"https://git.kernel.org/stable/c/8473135f89c0949436a22adb05b8cece2fb3da91\"}, {\"url\": \"https://git.kernel.org/stable/c/0439d541aa8d3444ad41c39e39eb71acb57acde3\"}, {\"url\": \"https://git.kernel.org/stable/c/91d44c1afc61a2fec37a9c7a3485368309391e0b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncdx: Fix possible UAF error in driver_override_show()\\n\\nFixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c\\n\\nThis function driver_override_show() is part of DEVICE_ATTR_RW, which\\nincludes both driver_override_show() and driver_override_store().\\nThese functions can be executed concurrently in sysfs.\\n\\nThe driver_override_store() function uses driver_set_override() to\\nupdate the driver_override value, and driver_set_override() internally\\nlocks the device (device_lock(dev)). If driver_override_show() reads\\ncdx_dev-\u003edriver_override without locking, it could potentially access\\na freed pointer if driver_override_store() frees the string\\nconcurrently. This could lead to printing a kernel address, which is a\\nsecurity risk since DEVICE_ATTR can be read by all users.\\n\\nAdditionally, a similar pattern is used in drivers/amba/bus.c, as well\\nas many other bus drivers, where device_lock() is taken in the show\\nfunction, and it has been working without issues.\\n\\nThis potential bug was detected by our experimental static analysis\\ntool, which analyzes locking APIs and paired functions to identify\\ndata races and atomicity violations.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.83\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.19\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.7\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:55:19.720Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21915\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:55:19.720Z\", \"dateReserved\": \"2024-12-29T08:45:45.787Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-04-01T15:40:52.019Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.