CVE-2025-21934: rapidio: fix an API misues when rio_add_net() fails
In the Linux kernel, the following vulnerability has been resolved:
rapidio: fix an API misues when rioaddnet() fails
rioaddnet() calls deviceregister() and fails when deviceregister() fails. Thus, putdevice() should be used rather than kfree(). Add "mport->net = NULL;" to avoid a use after free issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the Linux kernel to include the fix for the rapidio issue: “rapidio: fix an API misues when rio_add_net() fails” (ensure that when rio_add_net() fails, put_device() is used rather than kfree() to avoid the use-after-free).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21934?
CVE-2025-21934 has been classified as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2025-21934?
To fix CVE-2025-21934, you should update to the latest version of the Linux kernel that addresses this vulnerability.
What components are impacted by CVE-2025-21934?
CVE-2025-21934 specifically affects the RapidIO subsystem in the Linux kernel.
What type of vulnerability is CVE-2025-21934?
CVE-2025-21934 is an API misuse vulnerability that affects device registration handling.
When was CVE-2025-21934 published?
CVE-2025-21934 was published as part of a security update for the Linux kernel.