CVE-2025-21661

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/01/2025
Last modified:
01/10/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> gpio: virtuser: fix missing lookup table cleanups<br /> <br /> When a virtuser device is created via configfs and the probe fails due<br /> to an incorrect lookup table, the table is not removed. This prevents<br /> subsequent probe attempts from succeeding, even if the issue is<br /> corrected, unless the device is released. Additionally, cleanup is also<br /> needed in the less likely case of platform_device_register_full()<br /> failure.<br /> <br /> Besides, a consistent memory leak in lookup_table-&gt;dev_id was spotted<br /> using kmemleak by toggling the live state between 0 and 1 with a correct<br /> lookup table.<br /> <br /> Introduce gpio_virtuser_remove_lookup_table() as the counterpart to the<br /> existing gpio_virtuser_make_lookup_table() and call it from all<br /> necessary points to ensure proper cleanup.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.11 (including) 6.12.10 (excluding)
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*