cbcvebase.
CVE-2025-21915
published 2025-04-01

CVE-2025-21915: In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.19%
8.9th percentile
In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs. The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users. Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues. This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations.

Affected

19 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.12.19-1 (forky)linux 6.12.19-1 (forky)
linuxlinux
linuxlinux>= 2959ab247061e67485d83b6af8feb3761ec08cb9 < d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bfd7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf
linuxlinux>= 2959ab247061e67485d83b6af8feb3761ec08cb9 < 8473135f89c0949436a22adb05b8cece2fb3da918473135f89c0949436a22adb05b8cece2fb3da91
linuxlinux>= 2959ab247061e67485d83b6af8feb3761ec08cb9 < 0439d541aa8d3444ad41c39e39eb71acb57acde30439d541aa8d3444ad41c39e39eb71acb57acde3
linuxlinux>= 2959ab247061e67485d83b6af8feb3761ec08cb9 < 91d44c1afc61a2fec37a9c7a3485368309391e0b91d44c1afc61a2fec37a9c7a3485368309391e0b
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.12.19-16.12.19-1
linuxlinux_kernel>= 0 < 6.12.19-16.12.19-1
linuxlinux_kernel>= 0 < 6.8.0-84.846.8.0-84.84
linuxlinux_kernel>= 6.13 < 6.13.76.13.7
linuxlinux_kernel>= 6.4 < 6.6.836.6.83
linuxlinux_kernel>= 6.7 < 6.12.196.12.19
msrcazl3_kernel_6.6.82.1-1_on_azure_linux_3.0
msrccbl2_kernel_5.15.182.1-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.