CVE-2025-21661
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/01/2025
Last modified:
01/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
gpio: virtuser: fix missing lookup table cleanups<br />
<br />
When a virtuser device is created via configfs and the probe fails due<br />
to an incorrect lookup table, the table is not removed. This prevents<br />
subsequent probe attempts from succeeding, even if the issue is<br />
corrected, unless the device is released. Additionally, cleanup is also<br />
needed in the less likely case of platform_device_register_full()<br />
failure.<br />
<br />
Besides, a consistent memory leak in lookup_table->dev_id was spotted<br />
using kmemleak by toggling the live state between 0 and 1 with a correct<br />
lookup table.<br />
<br />
Introduce gpio_virtuser_remove_lookup_table() as the counterpart to the<br />
existing gpio_virtuser_make_lookup_table() and call it from all<br />
necessary points to ensure proper cleanup.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.11 (including) | 6.12.10 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



