{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21810", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.772Z", "datePublished": "2025-02-27T20:01:01.630Z", "dateUpdated": "2026-08-05T11:54:37.861Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:37.861Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: class: Fix wild pointer dereferences in API class_dev_iter_next()\n\nThere are a potential wild pointer dereferences issue regarding APIs\nclass_dev_iter_(init|next|exit)(), as explained by below typical usage:\n\n// All members of @iter are wild pointers.\nstruct class_dev_iter iter;\n\n// class_dev_iter_init(@iter, @class, ...) checks parameter @class for\n// potential class_to_subsys() error, and it returns void type and does\n// not initialize its output parameter @iter, so caller can not detect\n// the error and continues to invoke class_dev_iter_next(@iter) even if\n// @iter still contains wild pointers.\nclass_dev_iter_init(&iter, ...);\n\n// Dereference these wild pointers in @iter here once suffer the error.\nwhile (dev = class_dev_iter_next(&iter)) { ... };\n\n// Also dereference these wild pointers here.\nclass_dev_iter_exit(&iter);\n\nActually, all callers of these APIs have such usage pattern in kernel tree.\nFix by:\n- Initialize output parameter @iter by memset() in class_dev_iter_init()\n and give callers prompt by pr_crit() for the error.\n- Check if @iter is valid in class_dev_iter_next()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Every affected consumer of class_dev_iter_*() is reached through local interfaces — `/proc/diskstats` and `/proc/partitions` (disk_seqf_start), cgroup `io.stat` (blkcg_fill_root_iostats), and the NFC generic-netlink `NFC_CMD_GET_DEVICE` dump. There is no remote or adjacent-network consumer of this driver-core API.\nAC:L - Once the code path is entered the wild dereference is deterministic, and the attacker controls the memory that becomes the iterator: on the two most reachable paths the iterator is a plain unzeroed `kmalloc(32)` object, so an unprivileged process can pre-spray `kmalloc-32` with chosen bytes and repeat the triggering read/dump arbitrarily often until the layout lands.\nPR:L - `/proc/diskstats`, `/proc/partitions` and cgroup `io.stat` are world-readable, and the NFC `NFC_CMD_GET_DEVICE` dumpit entry in `nfc_genl_ops[]` is one of the few NFC operations with no `GENL_ADMIN_PERM` flag — so an ordinary unprivileged local user reaches `class_dev_iter_next()` with no capability of any kind.\nUI:N - The attacker triggers the path entirely on their own by reading a procfs file or issuing a netlink dump; no victim action, mount, or device plug-in is involved.\nS:U - The corruption and any resulting code execution stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `klist_next()` dereferences the uninitialized `i_klist` and walks `k_list`/`n_node` links, giving an attacker-directed read of arbitrary kernel memory that is then reflected through the iteration; combined with the call gadget this yields full memory disclosure.\nI:H - The uninitialized iterator drives `spin_lock_irqsave()` on a controlled address, a `kref_put`/`list_del` write pair in `klist_dec_and_del()`, and finally an indirect call `put(last)` through a function pointer read from attacker-groomable memory — an arbitrary-write and control-flow-hijack primitive.\nA:H - Even without successful grooming, dereferencing wild pointers in `klist_next()`/`klist_iter_exit()`/`subsys_put()` reliably produces a kernel oops or panic, and it happens while holding a spinlock with interrupts disabled." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/base/class.c" ], "versions": [ { "version": "7b884b7f24b42fa25e92ed724ad82f137610afaf", "lessThan": "f4b9bc823b0cfdebfed479c0e87d6939c7562e87", "status": "affected", "versionType": "git" }, { "version": "7b884b7f24b42fa25e92ed724ad82f137610afaf", "lessThan": "1614e75d1a1b63db6421c7a4bf37004720c7376c", "status": "affected", "versionType": "git" }, { "version": "7b884b7f24b42fa25e92ed724ad82f137610afaf", "lessThan": "5c504e9767b947cf7d4e29b811c0c8b3c53242b7", "status": "affected", "versionType": "git" }, { "version": "7b884b7f24b42fa25e92ed724ad82f137610afaf", "lessThan": "e128f82f7006991c99a58114f70ef61e937b1ac1", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/base/class.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f4b9bc823b0cfdebfed479c0e87d6939c7562e87" }, { "url": "https://git.kernel.org/stable/c/1614e75d1a1b63db6421c7a4bf37004720c7376c" }, { "url": "https://git.kernel.org/stable/c/5c504e9767b947cf7d4e29b811c0c8b3c53242b7" }, { "url": "https://git.kernel.org/stable/c/e128f82f7006991c99a58114f70ef61e937b1ac1" } ], "title": "driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()", "x_generator": { "engine": "bippy-1.2.0" } } } }