CVE-2025-23155

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: stmmac: Fix accessing freed irq affinity_hint<br /> <br /> In stmmac_request_irq_multi_msi(), a pointer to the stack variable<br /> cpu_mask is passed to irq_set_affinity_hint(). This value is stored in<br /> irq_desc-&gt;affinity_hint, but once stmmac_request_irq_multi_msi()<br /> returns, the pointer becomes dangling.<br /> <br /> The affinity_hint is exposed via procfs with S_IRUGO permissions,<br /> allowing any unprivileged process to read it. Accessing this stale<br /> pointer can lead to:<br /> <br /> - a kernel oops or panic if the referenced memory has been released and<br /> unmapped, or<br /> - leakage of kernel data into userspace if the memory is re-used for<br /> other purposes.<br /> <br /> All platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are<br /> affected.