CVE-2025-21671: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21671 Overview

CVE-2025-21671 is a use-after-free (UAF) vulnerability [CWE-416] in the Linux kernel's zram compressed block device driver. When zram_meta_alloc fails early during device initialization, it frees the allocated zram->table structure without setting the pointer to NULL. A local user who then resets the failed, uninitialized device can trigger zram_meta_free to access the freed table memory, leading to memory corruption or local privilege escalation.

The issue affects multiple stable branches of the Linux kernel and has been patched across the supported trees.

Critical Impact
A local, low-privileged attacker with access to the zram device can trigger memory corruption, potentially escalating privileges or causing kernel-level denial of service.

Affected Products

Linux Kernel (multiple stable versions prior to the referenced fix commits)
Distributions shipping vulnerable kernels, including Debian LTS
Systems with the zram module enabled (common on embedded, Android, and memory-constrained Linux workloads)

Discovery Timeline

2025-01-31 - CVE-2025-21671 published to NVD
2025-03 - Debian LTS advisory issued referencing the fix
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21671

Vulnerability Analysis

The zram driver provides compressed RAM-backed block devices on Linux. During device setup, zram_meta_alloc allocates a metadata table stored in zram->table. If a later step within the same allocation path fails, the function frees the table but leaves the zram->table pointer intact and dangling.

When a user subsequently issues a reset ioctl or writes to the reset sysfs attribute of the failed device, the driver invokes zram_meta_free. Because zram->table still references freed memory, the free path dereferences and operates on memory that has already been released. This constitutes a classic use-after-free condition tracked under [CWE-416].

Exploitation requires local access and the ability to interact with the zram device node, which typically requires privileges but may be reachable in containerized or multi-tenant contexts where device access is delegated.

Root Cause

The root cause is missing pointer nullification after error-path cleanup in zram_meta_alloc. The function calls vfree(zram->table) on the failure branch but does not assign zram->table = NULL. Subsequent code paths, notably zram_meta_free, use the non-null but stale pointer as if it referenced a valid allocation.

Attack Vector

A local user with permission to configure a zram device can force zram_meta_alloc to fail — for example, by exhausting memory or requesting an impractical size — and then trigger a device reset. The reset invokes zram_meta_free against freed memory. Reliable exploitation depends on reclaiming the freed slab allocation with attacker-controlled data prior to the second access.

Because the attack vector is local with low complexity and low privileges required, the impact spans confidentiality, integrity, and availability at the kernel level. No verified public exploit code is available at the time of writing, and this CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.

See the kernel commit series and the Debian LTS Announcement for authoritative technical details.

Detection Methods for CVE-2025-21671

Indicators of Compromise

Kernel oops or panic messages referencing zram_meta_free, zs_destroy_pool, or vfree on the zram code path
Repeated failed zram device initialization attempts followed by reset operations in kernel logs
Unexpected privilege escalation events originating from processes with zram device access

Detection Strategies

Audit kernel version and build metadata across the fleet to identify hosts running vulnerable zram-enabled kernels
Monitor dmesg and /var/log/kern.log for BUG: or KASAN reports referencing zram symbols
Correlate userspace activity against /sys/block/zram*/reset and the /dev/zram* device nodes

Monitoring Recommendations

Ingest kernel logs into a centralized platform and alert on zram-related fault signatures
Track processes that write to zram sysfs control files, especially in containerized workloads
Baseline normal zram provisioning behavior and flag repeated failed allocations followed by reset calls

How to Mitigate CVE-2025-21671

Immediate Actions Required

Apply the vendor-supplied kernel update from your Linux distribution as soon as it is available
Inventory systems that load the zram module and prioritize patching for multi-tenant, container, and shared hosts
Restrict access to /dev/zram* and /sys/block/zram* to trusted administrative users only

Patch Information

The upstream fix nullifies zram->table after freeing it in the error path of zram_meta_alloc. The fix has been backported across stable branches in the following commits: 212fe1c0, 571d3f60, 902ef8f1, and fe3de867. Debian users should reference the Debian LTS Announcement.

Workarounds

Unload the zram module (modprobe -r zram) on systems where compressed RAM devices are not required
Blacklist the zram module in /etc/modprobe.d/ to prevent auto-loading until the kernel is patched
Tighten permissions on zram control interfaces so that only root or a dedicated management account can configure devices

bash

# Prevent zram from loading on unpatched systems
echo "blacklist zram" | sudo tee /etc/modprobe.d/disable-zram.conf
sudo modprobe -r zram 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep zram