Riskcovery

CVE-2025-21998

firmware: qcom: uefisecapp: fix efivars registration race

State
Published
Severity
4.7 Medium
Published
Apr 3, 2025
Updated
May 11, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: uefisecapp: fix efivars registration race

Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access.

Make sure that all resources have been set up before registering the efivars.

Scores

CVSSScoreVectorSource
3.14.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 6612103ec35af6058bb85ab24dae28e119b3c055 to before c4e37b381a7a243c298a4858fc0a5a74e737c79aAffected
  • 6612103ec35af6058bb85ab24dae28e119b3c055 to before f15a2b96a0e41c426c63a932d0e63cde7b9784aaAffected
  • 6612103ec35af6058bb85ab24dae28e119b3c055 to before da8d493a80993972c427002684d0742560f3be4aAffected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.21 through 6.12.*Not affected
  • 6.13.9 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.