CVE-2025-21715
27.02.2025, 02:15
In the Linux kernel, the following vulnerability has been resolved:
net: davicom: fix UAF in dm9000_drv_remove
dm is netdev private data and it cannot be
used after free_netdev() call. Using dm after free_netdev()
can cause UAF bug. Fix it by moving free_netdev() at the end of the
function.
This is similar to the issue fixed in commit
ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove").
This bug is detected by our static analysis tool.Enginsight| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 4.4.262 ≤ 𝑥 < 4.5 |
| linux | linux_kernel | 4.9.262 ≤ 𝑥 < 4.10 |
| linux | linux_kernel | 4.14.226 ≤ 𝑥 < 4.15 |
| linux | linux_kernel | 4.19.181 ≤ 𝑥 < 4.20 |
| linux | linux_kernel | 5.4.106 ≤ 𝑥 < 5.4.291 |
| linux | linux_kernel | 5.10.24 ≤ 𝑥 < 5.10.235 |
| linux | linux_kernel | 5.11.7 ≤ 𝑥 < 5.15.179 |
| linux | linux_kernel | 5.16 ≤ 𝑥 < 6.1.129 |
| linux | linux_kernel | 6.2 ≤ 𝑥 < 6.6.76 |
| linux | linux_kernel | 6.7 ≤ 𝑥 < 6.12.13 |
| linux | linux_kernel | 6.13 ≤ 𝑥 < 6.13.2 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration
References