Vulnerability DatabaseCVE-2025-21715

CVE-2025-21715:
Linux Kernel vulnerability analysis and mitigation

Overview

CVE-2025-21715 is a Use-After-Free (UAF) vulnerability discovered in the Linux kernel's Davicom network driver (dm9000). The vulnerability was identified on January 23, 2025, and disclosed on February 26, 2025. The issue affects the dm9000drvremove function in the Linux kernel's network subsystem, specifically in the Davicom driver implementation (Kernel Git).

Technical details

The vulnerability occurs when the netdev private data (dm) is accessed after free_netdev() is called, potentially leading to a Use-After-Free condition. The bug was detected through static analysis and is similar to a previously fixed issue in the QCOM EMAC driver. The CVSS v3.1 base score is 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements with low attack complexity (NVD).

Impact

The vulnerability could allow an attacker with local access to potentially execute arbitrary code or cause system crashes through the improper use of freed memory. This could lead to privilege escalation or system instability in affected Linux systems using the Davicom network driver (NVD).

Mitigation and workarounds

The issue has been patched by moving the freenetdev() call to the end of the dm9000drv_remove function, ensuring that the netdev private data is not accessed after being freed. The fix has been implemented in the Linux kernel through multiple commits across different branches (Kernel Git).