CVE-2025-21671: zram: fix potential UAF of zram table
In the Linux kernel, the following vulnerability has been resolved:
zram: fix potential UAF of zram table
If zrammetaalloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zrammetafree to access the table if user reset an failed and uninitialized device.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
zram: fix potential UAF of zram table
If zrammetaalloc failed early, it frees allocated zram-table without setting it NULL. Which will potentially cause zrammetafree to access the table if user reset an failed and uninitialized device.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21671?
CVE-2025-21671 has been rated with a high severity due to the potential for a use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2025-21671?
To fix CVE-2025-21671, update your Linux kernel to versions 6.1.128 or later, or apply the relevant patches provided by the Linux community.
Which Linux kernel versions are affected by CVE-2025-21671?
CVE-2025-21671 affects Linux kernel versions 6.1.122 to 6.1.127, 6.6.68 to 6.6.74, and 6.12.7 to 6.12.11.
What is a use-after-free vulnerability as seen in CVE-2025-21671?
In the context of CVE-2025-21671, a use-after-free vulnerability occurs when a program continues to access memory after it has been freed, potentially leading to memory corruption.
Can CVE-2025-21671 be exploited remotely?
CVE-2025-21671 could potentially allow a local user to exploit the vulnerability, but its remote exploitability depends on the specific configurations and workloads.