CVE-2025-21998: firmware: qcom: uefisecapp: fix efivars registration race
In the Linux kernel, the following vulnerability has been resolved:
firmware: qcom: uefisecapp: fix efivars registration race
Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access.
Make sure that all resources have been set up before registering the efivars.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure all resources, including the memory pool, are set up before registering the efivars service to prevent the EFI variable access race and NULL-pointer dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21998?
CVE-2025-21998 has a medium severity rating due to potential memory allocation issues in the Linux kernel.
How do I fix CVE-2025-21998?
To fix CVE-2025-21998, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2025-21998?
CVE-2025-21998 affects certain versions of the Linux kernel using the TZ allocator for efivars registration.
Can CVE-2025-21998 lead to system instability?
Yes, CVE-2025-21998 can lead to system instability due to a potential race condition in memory pool allocation.
Is there a workaround for CVE-2025-21998?
There are no documented workarounds for CVE-2025-21998; the recommended action is to apply the kernel update.