Riskcovery

CVE-2025-21856

s390/ism: add release function for struct device

State
Published
Severity
7.8 High
Published
Mar 12, 2025
Updated
May 11, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/ism: add release function for struct device

According to device_release() in /drivers/base/core.c, a device without a release function is a broken device and must be fixed.

The current code directly frees the device after calling device_add() without waiting for other kernel parts to release their references. Thus, a reference could still be held to a struct device, e.g., by sysfs, leading to potential use-after-free issues if a proper release function is not set.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 8c81ba20349daf9f7e58bb05a0c12f4b71813a30 to before 940d15254d2216b585558bcf36312da50074e711Affected
  • 8c81ba20349daf9f7e58bb05a0c12f4b71813a30 to before 0505ff2936f166405d81d0d454a81d9c14124344Affected
  • 8c81ba20349daf9f7e58bb05a0c12f4b71813a30 to before e26e8ac27351f457091459a0a355bacd06d5bb2bAffected
  • 8c81ba20349daf9f7e58bb05a0c12f4b71813a30 to before 915e34d5ad35a6a9e56113f852ade4a730fb88f0Affected
LinuxLinux
  • 6.3Affected
  • before 6.3Not affected
  • 6.6.80 through 6.6.*Not affected
  • 6.12.17 through 6.12.*Not affected
  • 6.13.5 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.