CVE-2025-21934

Published: Apr 1, 2025Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rio_add_net() fails rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "mport->net = NULL;" to avoid a use after free issue.

Affected (12)

Products: Linux: Linux Kernel

1 product

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	4.6 ≤ version < 5.4.291
Linux Linux Kernel	5.11 ≤ version < 5.15.179
Linux Linux Kernel	5.16 ≤ version < 6.1.131
Linux Linux Kernel	5.5 ≤ version < 5.10.235
Linux Linux Kernel	6.13 ≤ version < 6.13.7
Linux Linux Kernel	6.2 ≤ version < 6.6.83
Linux Linux Kernel	6.7 ≤ version < 6.12.19
Linux Linux Kernel	Version 6.14 rc1
Linux Linux Kernel	Version 6.14 rc2
Linux Linux Kernel	Version 6.14 rc3
Linux Linux Kernel	Version 6.14 rc4
Linux Linux Kernel	Version 6.14 rc5

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (10)

https://git.kernel.org/stable/c/22e4977141dfc6d109bf29b495bf2187b4250990

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/2537f01d57f08c527e40bbb5862aa6ff43344898

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/88ddad53e4cfb6de861c6d4fb7b25427f46baed5

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/a5f5e520e8fbc6294020ff8afa36f684d92c6e6a

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/b2ef51c74b0171fde7eb69b6152d3d2f743ef269

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/cdd9f58f7fe41a55fae4305ea51fc234769fd466

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/d4ec862ce80f64db923a1d942b5d11cf6fc87d36

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/f0aa4ee1cbbf7789907e5a3f6810de01c146c211

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.