Riskcovery

CVE-2025-23155

net: stmmac: Fix accessing freed irq affinity_hint

State
Published
Severity
7.1 High
Published
May 1, 2025
Updated
Aug 5, 2026
Reserved
Jan 11, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Fix accessing freed irq affinity_hint

In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(). This value is stored in irq_desc->affinity_hint, but once stmmac_request_irq_multi_msi() returns, the pointer becomes dangling.

The affinity_hint is exposed via procfs with S_IRUGO permissions, allowing any unprivileged process to read it. Accessing this stale pointer can lead to:

- a kernel oops or panic if the referenced memory has been released and unmapped, or - leakage of kernel data into userspace if the memory is re-used for other purposes.

All platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are affected.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 8deec94c6040bb4a767f6e9456a0a44c7f2e713e to before 2fbf67ddb8a0d0efc00d2df496a9843ec318d48bAffected
  • 8deec94c6040bb4a767f6e9456a0a44c7f2e713e to before 960dab23f6d405740c537d095f90a4ee9ddd9285Affected
  • 8deec94c6040bb4a767f6e9456a0a44c7f2e713e to before 442312c2a90d60c7a5197246583fa91d9e579985Affected
  • 8deec94c6040bb4a767f6e9456a0a44c7f2e713e to before e148266e104fce396ad624079a6812ac3a9982efAffected
  • 8deec94c6040bb4a767f6e9456a0a44c7f2e713e to before 9e51a6a44e2c4de780a26e8fe110d708e806a8cdAffected
  • 8deec94c6040bb4a767f6e9456a0a44c7f2e713e to before c60d101a226f18e9a8f01bb4c6ca2b47dfcb15efAffected
LinuxLinux
  • 5.13Affected
  • before 5.13Not affected
  • 6.1.164 through 6.1.*Not affected
  • 6.6.117 through 6.6.*Not affected
  • 6.12.36 through 6.12.*Not affected
  • 6.13.12 through 6.13.*Not affected
  • 6.14.3 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.