PT-2025-14324 · Linux+7 · Linux Kernel+7
Published
2025-02-24
·
Updated
2026-01-20
·
CVE-2025-21943
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability in the Linux kernel has been resolved, related to the gpio aggregator driver. The issue arises when the
new device store and delete device store handlers touch module global resources, such as gpio aggregator lock, without holding a reference, leading to potential race conditions with module unload. This can cause various issues, including dangling platform devices and GPIO forwarders, resulting in system instability and warnings. A reproducer script demonstrates these problems by concurrently allocating and deallocating devices while unloading the module.Recommendations
To resolve this issue, apply the patch that adds
try module get() in the new device store and delete device store handlers. As a temporary workaround, consider restricting the use of the gpio aggregator driver until the patch is applied. Avoid using the new device store and delete device store handlers concurrently with module unload to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu