CVE-2025-21915 (GCVE-0-2025-21915)
Vulnerability from cvelistv5
Published
2025-04-01 15:40
Modified
2026-08-05 11:55
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs. The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users. Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues. This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2959ab247061e67485d83b6af8feb3761ec08cb9
Version: 2959ab247061e67485d83b6af8feb3761ec08cb9
Version: 2959ab247061e67485d83b6af8feb3761ec08cb9
Version: 2959ab247061e67485d83b6af8feb3761ec08cb9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21915",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-21T14:57:30.156471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-21T15:01:46.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cdx/cdx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf",
              "status": "affected",
              "version": "2959ab247061e67485d83b6af8feb3761ec08cb9",
              "versionType": "git"
            },
            {
              "lessThan": "8473135f89c0949436a22adb05b8cece2fb3da91",
              "status": "affected",
              "version": "2959ab247061e67485d83b6af8feb3761ec08cb9",
              "versionType": "git"
            },
            {
              "lessThan": "0439d541aa8d3444ad41c39e39eb71acb57acde3",
              "status": "affected",
              "version": "2959ab247061e67485d83b6af8feb3761ec08cb9",
              "versionType": "git"
            },
            {
              "lessThan": "91d44c1afc61a2fec37a9c7a3485368309391e0b",
              "status": "affected",
              "version": "2959ab247061e67485d83b6af8feb3761ec08cb9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cdx/cdx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.83",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncdx: Fix possible UAF error in driver_override_show()\n\nFixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c\n\nThis function driver_override_show() is part of DEVICE_ATTR_RW, which\nincludes both driver_override_show() and driver_override_store().\nThese functions can be executed concurrently in sysfs.\n\nThe driver_override_store() function uses driver_set_override() to\nupdate the driver_override value, and driver_set_override() internally\nlocks the device (device_lock(dev)). If driver_override_show() reads\ncdx_dev-\u003edriver_override without locking, it could potentially access\na freed pointer if driver_override_store() frees the string\nconcurrently. This could lead to printing a kernel address, which is a\nsecurity risk since DEVICE_ATTR can be read by all users.\n\nAdditionally, a similar pattern is used in drivers/amba/bus.c, as well\nas many other bus drivers, where device_lock() is taken in the show\nfunction, and it has been working without issues.\n\nThis potential bug was detected by our experimental static analysis\ntool, which analyzes locking APIs and paired functions to identify\ndata races and atomicity violations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only by read(2) on the local sysfs attribute /sys/bus/cdx/devices/\u003cdev\u003e/driver_override; no network, adjacent-network, or physical vector reaches driver_override_show().\nAC:H - The dangling read is only possible in the narrow window during which a privileged writer (driver_override_store()/device teardown) frees the old string, and the attacker cannot induce that write \u2014 plus CDX_BUS is a non-default, platform-specific config (OF \u0026\u0026 ARM64, absent from arm64 defconfig).\nPR:L - The exploiting side of the race is the read, and DEVICE_ATTR_RW creates the file mode 0644, so any unprivileged local user can open and repeatedly read it \u2014 the upstream fix explicitly cites \"DEVICE_ATTR can be read by all users\" as the security risk.\nUI:N - The attacker\u0027s own read loop needs no victim action; the concurrent override write occurs during routine automated device bind/unbind (udev/orchestration) rather than requiring a user to be tricked into anything, and the timing dependency is already charged under AC:H.\nS:U - The freed memory and the leaking sysfs read are both in the kernel\u0027s own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - vsnprintf(\"%s\") walks the freed slab object until a NUL byte, so up to a full PAGE_SIZE of reallocated kernel heap \u2014 including kernel pointers and whatever objects landed in the freed kmalloc slot \u2014 is copied verbatim to any unprivileged reader, defeating KASLR and disclosing arbitrary adjacent kernel data.\nI:H - This is a CWE-416 use-after-free on a heap object whose contents the attacker can influence by spraying the freed kmalloc slot; per UAF handling the integrity impact is High, and the disclosed heap/pointer state directly enables control-flow-hijack chains against the same kernel.\nA:H - Dereferencing the freed pointer can oops \u2014 under KASAN/panic_on_warn it panics immediately, and with SLUB poisoning (no NUL in the 0x6b fill) the string walk can run off the slab page into unmapped memory, faulting in kernel context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:19.720Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/8473135f89c0949436a22adb05b8cece2fb3da91"
        },
        {
          "url": "https://git.kernel.org/stable/c/0439d541aa8d3444ad41c39e39eb71acb57acde3"
        },
        {
          "url": "https://git.kernel.org/stable/c/91d44c1afc61a2fec37a9c7a3485368309391e0b"
        }
      ],
      "title": "cdx: Fix possible UAF error in driver_override_show()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21915",
    "datePublished": "2025-04-01T15:40:52.019Z",
    "dateReserved": "2024-12-29T08:45:45.787Z",
    "dateUpdated": "2026-08-05T11:55:19.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21915\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-21T14:57:30.156471Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-21T14:57:31.680Z\"}}], \"cna\": {\"title\": \"cdx: Fix possible UAF error in driver_override_show()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only by read(2) on the local sysfs attribute /sys/bus/cdx/devices/\u003cdev\u003e/driver_override; no network, adjacent-network, or physical vector reaches driver_override_show().\\nAC:H - The dangling read is only possible in the narrow window during which a privileged writer (driver_override_store()/device teardown) frees the old string, and the attacker cannot induce that write \\u2014 plus CDX_BUS is a non-default, platform-specific config (OF \u0026\u0026 ARM64, absent from arm64 defconfig).\\nPR:L - The exploiting side of the race is the read, and DEVICE_ATTR_RW creates the file mode 0644, so any unprivileged local user can open and repeatedly read it \\u2014 the upstream fix explicitly cites \\\"DEVICE_ATTR can be read by all users\\\" as the security risk.\\nUI:N - The attacker\u0027s own read loop needs no victim action; the concurrent override write occurs during routine automated device bind/unbind (udev/orchestration) rather than requiring a user to be tricked into anything, and the timing dependency is already charged under AC:H.\\nS:U - The freed memory and the leaking sysfs read are both in the kernel\u0027s own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - vsnprintf(\\\"%s\\\") walks the freed slab object until a NUL byte, so up to a full PAGE_SIZE of reallocated kernel heap \\u2014 including kernel pointers and whatever objects landed in the freed kmalloc slot \\u2014 is copied verbatim to any unprivileged reader, defeating KASLR and disclosing arbitrary adjacent kernel data.\\nI:H - This is a CWE-416 use-after-free on a heap object whose contents the attacker can influence by spraying the freed kmalloc slot; per UAF handling the integrity impact is High, and the disclosed heap/pointer state directly enables control-flow-hijack chains against the same kernel.\\nA:H - Dereferencing the freed pointer can oops \\u2014 under KASAN/panic_on_warn it panics immediately, and with SLUB poisoning (no NUL in the 0x6b fill) the string walk can run off the slab page into unmapped memory, faulting in kernel context.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2959ab247061e67485d83b6af8feb3761ec08cb9\", \"lessThan\": \"d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2959ab247061e67485d83b6af8feb3761ec08cb9\", \"lessThan\": \"8473135f89c0949436a22adb05b8cece2fb3da91\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2959ab247061e67485d83b6af8feb3761ec08cb9\", \"lessThan\": \"0439d541aa8d3444ad41c39e39eb71acb57acde3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2959ab247061e67485d83b6af8feb3761ec08cb9\", \"lessThan\": \"91d44c1afc61a2fec37a9c7a3485368309391e0b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/cdx/cdx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/cdx/cdx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf\"}, {\"url\": \"https://git.kernel.org/stable/c/8473135f89c0949436a22adb05b8cece2fb3da91\"}, {\"url\": \"https://git.kernel.org/stable/c/0439d541aa8d3444ad41c39e39eb71acb57acde3\"}, {\"url\": \"https://git.kernel.org/stable/c/91d44c1afc61a2fec37a9c7a3485368309391e0b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncdx: Fix possible UAF error in driver_override_show()\\n\\nFixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c\\n\\nThis function driver_override_show() is part of DEVICE_ATTR_RW, which\\nincludes both driver_override_show() and driver_override_store().\\nThese functions can be executed concurrently in sysfs.\\n\\nThe driver_override_store() function uses driver_set_override() to\\nupdate the driver_override value, and driver_set_override() internally\\nlocks the device (device_lock(dev)). If driver_override_show() reads\\ncdx_dev-\u003edriver_override without locking, it could potentially access\\na freed pointer if driver_override_store() frees the string\\nconcurrently. This could lead to printing a kernel address, which is a\\nsecurity risk since DEVICE_ATTR can be read by all users.\\n\\nAdditionally, a similar pattern is used in drivers/amba/bus.c, as well\\nas many other bus drivers, where device_lock() is taken in the show\\nfunction, and it has been working without issues.\\n\\nThis potential bug was detected by our experimental static analysis\\ntool, which analyzes locking APIs and paired functions to identify\\ndata races and atomicity violations.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.83\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.19\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.7\", \"versionStartIncluding\": \"6.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:55:19.720Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21915\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:55:19.720Z\", \"dateReserved\": \"2024-12-29T08:45:45.787Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-04-01T15:40:52.019Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.