CVE-2025-21715: net: davicom: fix UAF in dm9000_drv_remove
In the Linux kernel, the following vulnerability has been resolved:
net: davicom: fix UAF in dm9000drvremove
dm is netdev private data and it cannot be used after freenetdev() call. Using dm after freenetdev() can cause UAF bug. Fix it by moving freenetdev() at the end of the function.
This is similar to the issue fixed in commit ad297cd2db89 ("net: qcom/emac: fix UAF in emacremove").
This bug is detected by our static analysis tool.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21715?
CVE-2025-21715 has a medium severity due to the potential for use-after-free vulnerabilities affecting the Linux kernel.
How do I fix CVE-2025-21715?
To fix CVE-2025-21715, upgrade to the latest version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2025-21715?
CVE-2025-21715 affects various versions of the Linux kernel that utilize the davicom dm9000 driver.
Is CVE-2025-21715 easily exploitable?
Exploitation of CVE-2025-21715 requires local access and is dependent on specific conditions in the network environment.
Where can I find more information about CVE-2025-21715?
Further details about CVE-2025-21715 can be found in the official Linux kernel repositories and security advisories.