{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21914", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.787Z", "datePublished": "2025-04-01T15:40:51.437Z", "dateUpdated": "2026-08-05T11:55:18.648Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:18.648Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslimbus: messaging: Free transaction ID in delayed interrupt scenario\n\nIn case of interrupt delay for any reason, slim_do_transfer()\nreturns timeout error but the transaction ID (TID) is not freed.\nThis results into invalid memory access inside\nqcom_slim_ngd_rx_msgq_cb() due to invalid TID.\n\nFix the issue by freeing the TID in slim_do_transfer() before\nreturning timeout error to avoid invalid memory access.\n\nCall trace:\n__memcpy_fromio+0x20/0x190\nqcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl]\nvchan_complete+0x2a0/0x4a0\ntasklet_action_common+0x274/0x700\ntasklet_action+0x28/0x3c\n_stext+0x188/0x620\nrun_ksoftirqd+0x34/0x74\nsmpboot_thread_fn+0x1d8/0x464\nkthread+0x178/0x238\nret_from_fork+0x10/0x20\nCode: aa0003e8 91000429 f100044a 3940002b (3800150b)\n---[ end trace 0fe00bec2b975c99 ]---\nKernel panic - not syncing: Oops: Fatal exception in interrupt." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - SLIMbus is an on-SoC hardware bus with no network exposure; the vulnerable transfer path is reached from local userspace through ALSA control/PCM ioctls on /dev/snd → ASoC codec (wcd9335/wcd934x) → regmap-slimbus → slim_read()/slim_write() → slim_do_transfer(). No physical device attachment is required, so this is Local rather than Physical.\nAC:L - A local attacker drives both sides of the condition — issuing many concurrent SLIMbus transactions via mixer/PCM operations while loading CPUs and softirq processing to push the 1-second TX/response completion past its timeout, after which the delayed DMA response still arrives and hits the stale IDR entry. The attacker also influences what reoccupies the freed stack frame via subsequent syscalls on the same kernel stack, so no condition is truly outside their control.\nPR:L - Only an ordinary local account with access to the sound devices is needed (audio group on desktops/embedded, the audio process on Android); there is no capability check, credential gate, or root requirement anywhere between the ioctl entry point and slim_do_transfer().\nUI:N - The attacker triggers the SLIMbus transactions and the timeout directly from their own process; no victim action, mount, or file open is required.\nS:U - The dangling-pointer dereference and resulting memory corruption occur entirely within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - slim_msg_response() dereferences a freed stack frame (txn->msg, msg->rbuf, txn->comp), reading whatever reclaimed data now occupies it, and copies controller data through that attacker-influenceable pointer; per use-after-free guidance this yields an arbitrary-read primitive and kernel memory disclosure.\nI:H - memcpy(msg->rbuf, reply, len) writes response bytes to a pointer taken from reclaimed stack memory, and complete(txn->comp) performs spinlock/list-manipulation on a second stale pointer, giving a controllable write primitive suitable for heap/stack grooming and control-flow hijack.\nA:H - The reported failure is a fatal oops inside interrupt/softirq context ending in \"Kernel panic - not syncing\", and the corruption is triggerable repeatedly; additionally the leaked TIDs exhaust the 256-entry IDR space." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/slimbus/messaging.c" ], "versions": [ { "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0", "lessThan": "cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9fe", "status": "affected", "versionType": "git" }, { "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0", "lessThan": "a32e5198a9134772eb03f7b72a7849094c55bda9", "status": "affected", "versionType": "git" }, { "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0", "lessThan": "09d34c4cbc38485c7514069f25348e439555b282", "status": "affected", "versionType": "git" }, { "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0", "lessThan": "18ae4cee05c310c299ba75d7477dcf34be67aa16", "status": "affected", "versionType": "git" }, { "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0", "lessThan": "faac8e894014e8167471a8e4a5eb35a8fefbb82a", "status": "affected", "versionType": "git" }, { "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0", "lessThan": "6abf3d8bb51cbaf886c3f08109a0462890b10db6", "status": "affected", "versionType": "git" }, { "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0", "lessThan": "0c541c8f6da23e0b92f0a6216d899659a7572074", "status": "affected", "versionType": "git" }, { "version": "afbdcc7c384b0d446da08b1e0901dc176b41b9e0", "lessThan": "dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/slimbus/messaging.c" ], "versions": [ { "version": "4.16", "status": "affected" }, { "version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.291", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.235", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.131", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.83", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.19", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.7", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.4.291" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.10.235" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.131" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.12.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.13.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9fe" }, { "url": "https://git.kernel.org/stable/c/a32e5198a9134772eb03f7b72a7849094c55bda9" }, { "url": "https://git.kernel.org/stable/c/09d34c4cbc38485c7514069f25348e439555b282" }, { "url": "https://git.kernel.org/stable/c/18ae4cee05c310c299ba75d7477dcf34be67aa16" }, { "url": "https://git.kernel.org/stable/c/faac8e894014e8167471a8e4a5eb35a8fefbb82a" }, { "url": "https://git.kernel.org/stable/c/6abf3d8bb51cbaf886c3f08109a0462890b10db6" }, { "url": "https://git.kernel.org/stable/c/0c541c8f6da23e0b92f0a6216d899659a7572074" }, { "url": "https://git.kernel.org/stable/c/dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a" } ], "title": "slimbus: messaging: Free transaction ID in delayed interrupt scenario", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:39:02.707Z" } } ] } }