CVE-2025-21950 — Linux vulnerability
69 documents6 sources
Severity
7.1HIGHNVD
OSV8.8OSV7.8OSV5.9OSV5.5OSV4.7
EPSS
0.1%
top 82.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 1
Latest updateOct 15
Description
In the Linux kernel, the following vulnerability has been resolved:
drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
In the "pmcmd_ioctl" function, three memory objects allocated by
kmalloc are initialized by "hcall_get_cpu_state", which are then
copied to user space. The initializer is indeed implemented in
"acrn_hypercall2" (arch/x86/include/asm/acrn.h). There is a risk of
information leakage due to uninitialized bytes.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages6 packages
▶CVEListV5linux/linux3d679d5aec648f50e645702929890b9611998a0b — 4e15cf870d2c748e45d45ffc4d5b1dc1b7d50120+6
Also affects: Debian Linux 11.0