CVE-2025-21661 (GCVE-0-2025-21661)

Vulnerability from cvelistv5 – Published: 2025-01-21 12:18 – Updated: 2026-08-05 11:53
VLAI
Title
gpio: virtuser: fix missing lookup table cleanups
Summary
In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix missing lookup table cleanups When a virtuser device is created via configfs and the probe fails due to an incorrect lookup table, the table is not removed. This prevents subsequent probe attempts from succeeding, even if the issue is corrected, unless the device is released. Additionally, cleanup is also needed in the less likely case of platform_device_register_full() failure. Besides, a consistent memory leak in lookup_table->dev_id was spotted using kmemleak by toggling the live state between 0 and 1 with a correct lookup table. Introduce gpio_virtuser_remove_lookup_table() as the counterpart to the existing gpio_virtuser_make_lookup_table() and call it from all necessary points to ensure proper cleanup.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 91581c4b3f29e2e22aeb1a62e842d529ca638b2d , < d72d0126b1f6981f6ce8b4247305f359958c11b5 (git)
Affected: 91581c4b3f29e2e22aeb1a62e842d529ca638b2d , < a619cba8c69c434258ff4101d463322cd63e1bdc (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.10 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21661",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:52:33.900455Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:13.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-virtuser.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d72d0126b1f6981f6ce8b4247305f359958c11b5",
              "status": "affected",
              "version": "91581c4b3f29e2e22aeb1a62e842d529ca638b2d",
              "versionType": "git"
            },
            {
              "lessThan": "a619cba8c69c434258ff4101d463322cd63e1bdc",
              "status": "affected",
              "version": "91581c4b3f29e2e22aeb1a62e842d529ca638b2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-virtuser.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: virtuser: fix missing lookup table cleanups\n\nWhen a virtuser device is created via configfs and the probe fails due\nto an incorrect lookup table, the table is not removed. This prevents\nsubsequent probe attempts from succeeding, even if the issue is\ncorrected, unless the device is released. Additionally, cleanup is also\nneeded in the less likely case of platform_device_register_full()\nfailure.\n\nBesides, a consistent memory leak in lookup_table-\u003edev_id was spotted\nusing kmemleak by toggling the live state between 0 and 1 with a correct\nlookup table.\n\nIntroduce gpio_virtuser_remove_lookup_table() as the counterpart to the\nexisting gpio_virtuser_make_lookup_table() and call it from all\nnecessary points to ensure proper cleanup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through configfs mkdir/rmdir/write operations under /sys/kernel/config/gpio-virtuser/, which require local access to the system. There is no network or adjacent-network path to gpio-virtuser.\nAC:L - The attacker fully controls every step \u2014 the bad lookup key that forces probe failure, the removal of the configfs entry that frees the string still referenced by the leaked lookup table, the heap grooming (key length and content are attacker-chosen kstrdup allocations), and the re-activation that dereferences it. It is a deterministic shell-command sequence with no race and no dependence on uncontrolled state.\nPR:L - Write access to the gpio-virtuser configfs subtree is required, which on the realistic deployments for this testing driver (embedded/CI/GPIO test rigs and CAP_SYS_ADMIN containers) is delegated to an ordinary unprivileged test account rather than requiring init-namespace root. Choosing the higher-severity option where reachability depends on local policy, this is Low.\nUI:N - The entire sequence \u2014 create device, fail the probe, drop the lookup entry, re-activate \u2014 is performed by the attacker alone. No victim action or cooperation is needed.\nS:U - The stale lookup table, the freed strings, and the resulting corruption all live within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling key/con_id pointers are consumed by strcmp(), gpio_name_to_desc(), gpio_device_find_by_label() and, critically, by dev_warn(\"cannot find GPIO chip %s\", p-\u003ekey), which copies freed slab contents into dmesg \u2014 a directly observable kernel heap disclosure. With attacker-chosen allocation sizes the freed slot can be reclaimed by other kernel objects, yielding an arbitrary-ish heap read primitive.\nI:H - This is a use-after-free whose freed slab slot the attacker can reclaim with controlled data, which per standard kernel UAF assessment is exploitable for heap grooming and control-flow/data corruption. Even without full exploitation, a reclaimed key string causes gpiod_find() to bind a GPIO line other than the one requested, silently altering GPIO state on the affected device.\nA:H - Dereferencing the freed key/con_id pointers (strcmp on poisoned or unmapped memory) oopses the kernel, and every failed activation permanently leaks an entire gpiod_lookup_table onto the global gpio_lookup_list, giving an unbounded attacker-driven memory leak plus ever-growing traversal of a list taken under gpio_lookup_lock by every gpiod_get() in the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:26.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d72d0126b1f6981f6ce8b4247305f359958c11b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a619cba8c69c434258ff4101d463322cd63e1bdc"
        }
      ],
      "title": "gpio: virtuser: fix missing lookup table cleanups",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21661",
    "datePublished": "2025-01-21T12:18:16.902Z",
    "dateReserved": "2024-12-29T08:45:45.732Z",
    "dateUpdated": "2026-08-05T11:53:26.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21661",
      "date": "2026-08-08",
      "epss": "0.00183",
      "percentile": "0.08082"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21661\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-21T13:15:09.747\",\"lastModified\":\"2026-07-30T06:17:41.783\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpio: virtuser: fix missing lookup table cleanups\\n\\nWhen a virtuser device is created via configfs and the probe fails due\\nto an incorrect lookup table, the table is not removed. This prevents\\nsubsequent probe attempts from succeeding, even if the issue is\\ncorrected, unless the device is released. Additionally, cleanup is also\\nneeded in the less likely case of platform_device_register_full()\\nfailure.\\n\\nBesides, a consistent memory leak in lookup_table-\u003edev_id was spotted\\nusing kmemleak by toggling the live state between 0 and 1 with a correct\\nlookup table.\\n\\nIntroduce gpio_virtuser_remove_lookup_table() as the counterpart to the\\nexisting gpio_virtuser_make_lookup_table() and call it from all\\nnecessary points to ensure proper cleanup.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gpio: virtuser: corregir limpiezas de tablas de b\u00fasqueda faltantes Cuando se crea un dispositivo virtuser a trav\u00e9s de configfs y la sonda falla debido a una tabla de b\u00fasqueda incorrecta, la tabla no se elimina. Esto evita que los intentos de sonda posteriores tengan \u00e9xito, incluso si se corrige el problema, a menos que se libere el dispositivo. Adem\u00e1s, tambi\u00e9n se necesita limpieza en el caso menos probable de que falle platform_device_register_full(). Adem\u00e1s, se detect\u00f3 una p\u00e9rdida de memoria constante en lookup_table-\u0026gt;dev_id usando kmemleak alternando el estado activo entre 0 y 1 con una tabla de b\u00fasqueda correcta. Introduzca gpio_virtuser_remove_lookup_table() como contraparte del gpio_virtuser_make_lookup_table() existente y ll\u00e1melo desde todos los puntos necesarios para garantizar una limpieza adecuada. \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpio/gpio-virtuser.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"91581c4b3f29e2e22aeb1a62e842d529ca638b2d\",\"lessThan\":\"d72d0126b1f6981f6ce8b4247305f359958c11b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"91581c4b3f29e2e22aeb1a62e842d529ca638b2d\",\"lessThan\":\"a619cba8c69c434258ff4101d463322cd63e1bdc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpio/gpio-virtuser.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.10\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:52:33.900455Z\",\"id\":\"CVE-2025-21661\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"AD20F8BA-D1BC-4584-8C68-17E958381157\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a619cba8c69c434258ff4101d463322cd63e1bdc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d72d0126b1f6981f6ce8b4247305f359958c11b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:13:45+00:00",
      "cve": "CVE-2025-21661",
      "id": "CVE-2025-21661",
      "initial_release_date": "2025-01-21T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gpio: virtuser: fix missing lookup table cleanups",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21661.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21661\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:52:33.900455Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-401\", \"description\": \"CWE-401 Missing Release of Memory after Effective Lifetime\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:58:07.789Z\"}}], \"cna\": {\"title\": \"gpio: virtuser: fix missing lookup table cleanups\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached exclusively through configfs mkdir/rmdir/write operations under /sys/kernel/config/gpio-virtuser/, which require local access to the system. There is no network or adjacent-network path to gpio-virtuser.\\nAC:L - The attacker fully controls every step \\u2014 the bad lookup key that forces probe failure, the removal of the configfs entry that frees the string still referenced by the leaked lookup table, the heap grooming (key length and content are attacker-chosen kstrdup allocations), and the re-activation that dereferences it. It is a deterministic shell-command sequence with no race and no dependence on uncontrolled state.\\nPR:L - Write access to the gpio-virtuser configfs subtree is required, which on the realistic deployments for this testing driver (embedded/CI/GPIO test rigs and CAP_SYS_ADMIN containers) is delegated to an ordinary unprivileged test account rather than requiring init-namespace root. Choosing the higher-severity option where reachability depends on local policy, this is Low.\\nUI:N - The entire sequence \\u2014 create device, fail the probe, drop the lookup entry, re-activate \\u2014 is performed by the attacker alone. No victim action or cooperation is needed.\\nS:U - The stale lookup table, the freed strings, and the resulting corruption all live within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The dangling key/con_id pointers are consumed by strcmp(), gpio_name_to_desc(), gpio_device_find_by_label() and, critically, by dev_warn(\\\"cannot find GPIO chip %s\\\", p-\u003ekey), which copies freed slab contents into dmesg \\u2014 a directly observable kernel heap disclosure. With attacker-chosen allocation sizes the freed slot can be reclaimed by other kernel objects, yielding an arbitrary-ish heap read primitive.\\nI:H - This is a use-after-free whose freed slab slot the attacker can reclaim with controlled data, which per standard kernel UAF assessment is exploitable for heap grooming and control-flow/data corruption. Even without full exploitation, a reclaimed key string causes gpiod_find() to bind a GPIO line other than the one requested, silently altering GPIO state on the affected device.\\nA:H - Dereferencing the freed key/con_id pointers (strcmp on poisoned or unmapped memory) oopses the kernel, and every failed activation permanently leaks an entire gpiod_lookup_table onto the global gpio_lookup_list, giving an unbounded attacker-driven memory leak plus ever-growing traversal of a list taken under gpio_lookup_lock by every gpiod_get() in the system.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"91581c4b3f29e2e22aeb1a62e842d529ca638b2d\", \"lessThan\": \"d72d0126b1f6981f6ce8b4247305f359958c11b5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"91581c4b3f29e2e22aeb1a62e842d529ca638b2d\", \"lessThan\": \"a619cba8c69c434258ff4101d463322cd63e1bdc\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpio/gpio-virtuser.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpio/gpio-virtuser.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d72d0126b1f6981f6ce8b4247305f359958c11b5\"}, {\"url\": \"https://git.kernel.org/stable/c/a619cba8c69c434258ff4101d463322cd63e1bdc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpio: virtuser: fix missing lookup table cleanups\\n\\nWhen a virtuser device is created via configfs and the probe fails due\\nto an incorrect lookup table, the table is not removed. This prevents\\nsubsequent probe attempts from succeeding, even if the issue is\\ncorrected, unless the device is released. Additionally, cleanup is also\\nneeded in the less likely case of platform_device_register_full()\\nfailure.\\n\\nBesides, a consistent memory leak in lookup_table-\u003edev_id was spotted\\nusing kmemleak by toggling the live state between 0 and 1 with a correct\\nlookup table.\\n\\nIntroduce gpio_virtuser_remove_lookup_table() as the counterpart to the\\nexisting gpio_virtuser_make_lookup_table() and call it from all\\nnecessary points to ensure proper cleanup.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.10\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:53:26.900Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21661\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:53:26.900Z\", \"dateReserved\": \"2024-12-29T08:45:45.732Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-21T12:18:16.902Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.