CVE-2025-23155: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-23155) was identified in the Linux kernel's STMMAC network driver, discovered and disclosed on May 1, 2025. The issue involves accessing a freed IRQ affinity hint where a cpumask is incorrectly implemented as a local variable, while its pointer is saved to irq_desc and may be accessed from procfs (NVD, Wiz).

The technical issue stems from an implementation flaw in the STMMAC network driver where the cpumask is incorrectly defined as a local variable. The vulnerability occurs because this pointer is saved to irqdesc and can be accessed from procfs, potentially leading to use-after-free scenarios. The fix involves using the persistent mask cpumask_of(cpu#) instead of a local variable (Debian Tracker).

The vulnerability affects multiple versions of the Linux kernel across various distributions. According to the Ubuntu security tracker, this affects several current releases including Ubuntu 22.04 LTS, 24.04 LTS, 24.10, and 25.04, while older versions like 20.04 LTS and 18.04 LTS are not affected (Ubuntu).

Patches have been released to address this vulnerability. The fix involves modifying the code to use the persistent mask cpumask_of(cpu#) instead of a local variable. Several Linux distributions have already implemented fixes, with Debian's bullseye release being patched in versions 5.10.234-1 and 5.10.223-1 (Debian Tracker).