CVE-2025-21915 Overview
CVE-2025-21915 is a use-after-free vulnerability [CWE-416] in the Linux kernel's CDX bus driver, specifically in the driver_override_show() function within drivers/cdx/cdx.c. The flaw stems from a missing lock when reading cdx_dev->driver_override while driver_override_store() can concurrently free the string via driver_set_override(). A local, authenticated attacker can trigger the race through the sysfs interface exposed by DEVICE_ATTR_RW. Successful exploitation can leak kernel memory addresses or corrupt kernel state. The issue affects Linux kernel versions up through 6.14-rc5 and has been fixed via multiple stable-tree commits.
Critical Impact
Local users can trigger a kernel use-after-free through concurrent sysfs reads and writes, potentially disclosing kernel memory or compromising system integrity.
Affected Products
- Linux Kernel (mainline through 6.14-rc5)
- Linux Kernel 6.14-rc1, rc2, rc3, rc4, rc5
- Systems using the CDX bus driver (drivers/cdx/cdx.c)
Discovery Timeline
- 2025-04-01 - CVE-2025-21915 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-21915
Vulnerability Analysis
The vulnerability resides in the CDX (Composable DMA-capable eXtensible) bus driver's sysfs attribute handling. The driver_override_show() and driver_override_store() functions are paired as DEVICE_ATTR_RW, meaning both operate on the same driver_override string field of cdx_dev. These callbacks can execute concurrently across multiple threads accessing sysfs.
The store path uses driver_set_override(), which internally acquires device_lock(dev) before replacing and freeing the previous driver_override string. The show path, however, previously dereferenced cdx_dev->driver_override without taking the same lock. This asymmetry allows a reader thread to observe a pointer that a writer thread has already freed.
Root Cause
The root cause is missing synchronization between paired sysfs read and write handlers. The driver_override_show() function accessed a shared, dynamically allocated string without holding device_lock(dev), while driver_set_override() in the write path frees the old buffer under the lock. This atomicity violation produces a classic use-after-free window [CWE-416]. Similar bus drivers such as drivers/amba/bus.c correctly take device_lock() in the show path, confirming the intended locking discipline.
Attack Vector
Exploitation requires local access with permission to read and write the sysfs driver_override attribute of a CDX device. An attacker races two threads: one repeatedly writes new override values via driver_override_store() while another reads the attribute via driver_override_show(). Winning the race causes the reader to print freed heap memory into the sysfs buffer, which can leak kernel pointers useful for defeating KASLR or serve as a primitive toward further kernel exploitation. Because DEVICE_ATTR files are world-readable by default, the address disclosure aspect broadens the impact beyond privileged users.
No public proof-of-concept has been published. The vulnerability was identified by a static analysis tool auditing locking APIs and paired function pairs.
Detection Methods for CVE-2025-21915
Indicators of Compromise
- Unexpected kernel oops, GPFs, or KASAN use-after-free reports referencing driver_override_show or cdx symbols in dmesg.
- Unusual concurrent access patterns to /sys/bus/cdx/devices/*/driver_override from unprivileged processes.
- Kernel log entries showing pointer-like values or garbled strings returned from CDX driver_override reads.
Detection Strategies
- Enable KASAN on test kernels to surface the use-after-free during fuzzing or workload replay.
- Audit running kernel versions with uname -r and cross-reference against fixed stable-tree commits.
- Hunt EDR telemetry for processes performing high-frequency read/write syscalls against CDX sysfs paths.
Monitoring Recommendations
- Collect and centralize kernel ring buffer logs for oops, WARN, and KASAN signatures tied to cdx.c.
- Alert on non-root processes iterating /sys/bus/cdx/ attributes in tight loops.
- Track kernel package versions across the fleet and flag hosts still running unpatched 6.14-rc series or earlier vulnerable builds.
How to Mitigate CVE-2025-21915
Immediate Actions Required
- Update to a Linux kernel build that includes the upstream fix commits 0439d541, 8473135f, 91d44c1a, or d7b339bb.
- Restrict local shell access on systems exposing CDX devices, since exploitation requires local privileges.
- Verify running kernel version and confirm the patch is present before returning affected hosts to production.
Patch Information
The fix adds device_lock(dev) around the read of cdx_dev->driver_override in driver_override_show(), mirroring the pattern used by drivers/amba/bus.c. Patches are available in the stable trees at Linux Kernel Commit 0439d541, Linux Kernel Commit 8473135f, Linux Kernel Commit 91d44c1a, and Linux Kernel Commit d7b339bb. Apply the vendor-provided kernel update for your distribution.
Workarounds
- Where the CDX bus driver is not required, unload or disable the cdx module to remove the vulnerable code path.
- Restrict read and write permissions on /sys/bus/cdx/devices/*/driver_override to root-only using udev rules until patched.
- Limit interactive local access to trusted administrators on systems that expose CDX devices.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
