CVE-2025-21856 Overview
CVE-2025-21856 is a use-after-free vulnerability [CWE-416] in the Linux kernel's s390/ism driver. The flaw affects the Internal Shared Memory (ISM) device driver on IBM s390 architecture. The current code directly frees the device after calling device_add() without waiting for other kernel components to release their references. A reference to the struct device may still be held, for example by sysfs, leading to a use-after-free condition when a proper release function is not set.
Critical Impact
A local, authenticated attacker on an affected s390 system can exploit this use-after-free to compromise kernel memory integrity, potentially leading to privilege escalation or denial of service.
Affected Products
- Linux Kernel (multiple stable branches prior to fix)
- Linux Kernel 6.14-rc1
- Linux Kernel 6.14-rc2 and 6.14-rc3
Discovery Timeline
- 2025-03-12 - CVE-2025-21856 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21856
Vulnerability Analysis
The vulnerability resides in the s390/ism driver, which handles Internal Shared Memory devices used for high-speed inter-LPAR communication on IBM s390 mainframes. According to device_release() in /drivers/base/core.c, a struct device registered with the kernel must have a release function assigned. Without one, the kernel considers the device broken.
The defective code path calls device_add() to register the ISM device but then frees the device memory immediately, without waiting for reference holders to drop their references. Subsystems such as sysfs and the driver core routinely retain references to registered devices beyond the initial registration call. When those subsystems later access the freed memory through the stale pointer, the kernel operates on reclaimed or reused memory.
Root Cause
The root cause is a missing release callback on the struct device combined with premature deallocation. The Linux device model requires reference-counted lifetime management through kobject. The driver bypassed this contract by freeing storage synchronously, breaking the invariant that a device persists until its refcount reaches zero.
Attack Vector
Exploitation requires local access with low privileges on a Linux system running an affected kernel on s390 hardware. An attacker who can trigger the ISM device registration and teardown paths, or race sysfs access against device removal, can dereference freed kernel memory. Successful exploitation of use-after-free bugs in kernel device structures commonly enables arbitrary kernel memory writes and privilege escalation.
No verified public proof-of-concept exists for this issue. See the upstream fixes in the Kernel Git Commit 0505ff2 and Kernel Git Commit e26e8ac for the corrective code.
Detection Methods for CVE-2025-21856
Indicators of Compromise
- Kernel oops or panic messages referencing ism, device_release, or kobject release paths in dmesg and /var/log/kern.log.
- KASAN reports flagging use-after-free reads or writes within the s390/ism driver on instrumented kernels.
- Unexpected sysfs read failures or stale entries under /sys/devices/ corresponding to ISM devices after module unload.
Detection Strategies
- Enumerate running kernel versions across the fleet and flag s390 systems on kernels prior to the fixed stable releases referenced by the upstream commits.
- Enable KASAN and kernel lockdep in test environments to surface use-after-free conditions during ISM device lifecycle events.
- Monitor kernel ring buffer telemetry for repeated warnings from the driver core about devices without release functions.
Monitoring Recommendations
- Ingest kernel logs from s390 LPARs into a centralized logging platform and alert on BUG:, Oops, and KASAN strings.
- Track loading and unloading of the ism kernel module through auditd rules on init_module and delete_module syscalls.
- Correlate unprivileged user activity with ISM device state changes to detect abuse attempts.
How to Mitigate CVE-2025-21856
Immediate Actions Required
- Inventory all s390 Linux systems and identify kernels that predate the upstream fix commits.
- Apply the vendor-supplied kernel updates that incorporate the release-function patch for s390/ism.
- Restrict local shell access on affected mainframe LPARs to trusted administrators until patches are deployed.
Patch Information
The fix adds a proper release function to the ISM struct device and defers freeing until the device reference count drops to zero. Corrective commits are available at Kernel Git Commit 0505ff2, Kernel Git Commit 915e34d, Kernel Git Commit 940d152, and Kernel Git Commit e26e8ac. Rebuild and reboot into the patched kernel on all affected s390 systems.
Workarounds
- Blacklist the ism kernel module on s390 hosts that do not require ISM connectivity between LPARs.
- Enforce strict access controls that prevent unprivileged users from triggering device registration paths.
- Disable automatic module loading via modprobe.blacklist=ism in the kernel command line where operationally feasible.
# Blacklist the ism module until the kernel is patched
echo "blacklist ism" | sudo tee /etc/modprobe.d/blacklist-ism.conf
sudo depmod -a
# Verify the module is not loaded
lsmod | grep ism
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
