CVE-2025-21797: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21797 Overview

CVE-2025-21797 is a use-after-free vulnerability [CWE-416] in the Linux kernel's HID driver for Corsair Void headsets. The flaw resides in the corsair-void driver, where a missing cancel_delayed_work_sync() call in corsair_void_remove() leaves delayed work referencing freed memory. When the driver unloads or the device disconnects, the queued headset status work can execute against a destroyed context. The issue affects Linux kernel versions 6.14-rc1 and 6.14-rc2.

Critical Impact
Local attackers with the ability to trigger driver removal or device disconnection can exploit the use-after-free to corrupt kernel memory, potentially leading to privilege escalation or kernel crash.

Affected Products

Linux kernel 6.14-rc1
Linux kernel 6.14-rc2
Systems using the corsair-void HID driver with Corsair Void headsets

Discovery Timeline

2025-02-27 - CVE-2025-21797 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21797

Vulnerability Analysis

The corsair-void HID driver manages Corsair Void wireless headsets and schedules delayed work items to poll headset status such as battery level. During driver initialization, the code registers a delayed_work structure that periodically queries the device. The driver's removal path failed to cancel this pending work before releasing associated driver-private data.

When corsair_void_remove() executes without calling cancel_delayed_work_sync(), any still-queued or in-flight work item retains pointers to the freed driver context. The kernel's workqueue subsystem later dispatches the callback, which dereferences memory that has been released to the slab allocator. This produces a classic use-after-free condition in kernel context.

The upstream fix adds the required cancel_delayed_work_sync() invocation in the remove handler to ensure all pending work completes and no further callbacks fire before resources are freed. The patch is available in commits 2dcb56a and 48e487b on kernel.org.

Root Cause

The root cause is a missing synchronization call during driver teardown. Delayed work items scheduled by the corsair-void driver outlived the driver-private structures they operated on. Kernel workqueue APIs require explicit cancellation of pending work before freeing referenced memory to avoid dangling pointers.

Attack Vector

Exploitation requires local access with sufficient privileges to trigger driver unload or induce device disconnection events. An attacker who can influence USB device state or trigger module removal may cause the vulnerable code path to execute. The vulnerability does not require user interaction and impacts confidentiality, integrity, and availability at the kernel level.

The vulnerability manifests in the driver removal function. Refer to the Linux Kernel Commit 2dcb56a and Linux Kernel Commit 48e487b for the complete patch diff.

Detection Methods for CVE-2025-21797

Indicators of Compromise

Kernel oops or panic messages referencing corsair_void functions in stack traces
KASAN reports flagging use-after-free reads or writes within workqueue callbacks tied to the corsair-void module
Unexpected kernel crashes correlated with USB disconnect events for Corsair Void headsets

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test systems running kernel 6.14-rc1 or 6.14-rc2 to surface memory corruption events
Monitor dmesg and journalctl -k output for kernel warnings referencing corsair_void_remove or delayed work callbacks
Track loaded kernel modules and correlate corsair-void module unload events with subsequent kernel instability

Monitoring Recommendations

Collect kernel crash dumps and forward them to a centralized logging pipeline for correlation
Alert on kernel oops signatures containing corsair_void symbols or workqueue-related fault addresses
Baseline USB device attach and detach patterns on endpoints running affected release candidate kernels

How to Mitigate CVE-2025-21797

Immediate Actions Required

Upgrade to a Linux kernel release containing commits 2dcb56a and 48e487b, or move off 6.14-rc1 and 6.14-rc2 pre-release kernels
Restrict physical access to systems running affected kernels to prevent adversarial USB device manipulation
Audit deployments for use of release candidate kernels in production and revert to stable releases where possible

Patch Information

The fix adds the missing cancel_delayed_work_sync() call to corsair_void_remove(). Apply the patches referenced in Linux Kernel Commit 2dcb56a and Linux Kernel Commit 48e487b. Rebuild and redeploy affected kernels or install vendor-provided updates.

Workarounds

Blacklist the corsair-void module on systems that do not require Corsair Void headset support
Disconnect Corsair Void headsets and avoid unloading the driver on unpatched systems
Limit CAP_SYS_MODULE and root access to reduce the ability to trigger driver removal

bash

# Blacklist the corsair-void module to prevent loading
echo "blacklist corsair-void" | sudo tee /etc/modprobe.d/blacklist-corsair-void.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep corsair_void