CVE-2025-21917

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21917
In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Flush the notify_hotplug_work When performing continuous unbind/bind operations on the USB drivers available on the Renesas RZ/G2L SoC, a kernel crash with the message "Unable to handle kernel NULL pointer dereference at virtual address" may occur. This issue points to the usbhsc_notify_hotplug() function. Flush the delayed work to avoid its execution when driver resources are unavailable.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3248c1f833f924246cb98ce7da4569133c1b2292 Patch
https://git.kernel.org/stable/c/394965f90454d6f00fe11879142b720c6c1a872e Patch
https://git.kernel.org/stable/c/4ca078084cdd5f32d533311d6a0b63a60dcadd41 Patch
https://git.kernel.org/stable/c/4cd847a7b630a85493d0294ad9542c21aafaa246 Patch
https://git.kernel.org/stable/c/552ca6b87e3778f3dd5b87842f95138162e16c82 Patch
https://git.kernel.org/stable/c/830818c8e70c0364e377f0c243b28061ef7967eb Patch
https://git.kernel.org/stable/c/d50f5c0cd949593eb9a3d822b34d7b50046a06b7 Patch
https://git.kernel.org/stable/c/e5aac1c9b2974636db7ce796ffa6de88fa08335e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
History

11 Apr 2025, 13:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/3248c1f833f924246cb98ce7da4569133c1b2292 - () https://git.kernel.org/stable/c/3248c1f833f924246cb98ce7da4569133c1b2292 - Patch
References () https://git.kernel.org/stable/c/394965f90454d6f00fe11879142b720c6c1a872e - () https://git.kernel.org/stable/c/394965f90454d6f00fe11879142b720c6c1a872e - Patch
References () https://git.kernel.org/stable/c/4ca078084cdd5f32d533311d6a0b63a60dcadd41 - () https://git.kernel.org/stable/c/4ca078084cdd5f32d533311d6a0b63a60dcadd41 - Patch
References () https://git.kernel.org/stable/c/4cd847a7b630a85493d0294ad9542c21aafaa246 - () https://git.kernel.org/stable/c/4cd847a7b630a85493d0294ad9542c21aafaa246 - Patch
References () https://git.kernel.org/stable/c/552ca6b87e3778f3dd5b87842f95138162e16c82 - () https://git.kernel.org/stable/c/552ca6b87e3778f3dd5b87842f95138162e16c82 - Patch
References () https://git.kernel.org/stable/c/830818c8e70c0364e377f0c243b28061ef7967eb - () https://git.kernel.org/stable/c/830818c8e70c0364e377f0c243b28061ef7967eb - Patch
References () https://git.kernel.org/stable/c/d50f5c0cd949593eb9a3d822b34d7b50046a06b7 - () https://git.kernel.org/stable/c/d50f5c0cd949593eb9a3d822b34d7b50046a06b7 - Patch
References () https://git.kernel.org/stable/c/e5aac1c9b2974636db7ce796ffa6de88fa08335e - () https://git.kernel.org/stable/c/e5aac1c9b2974636db7ce796ffa6de88fa08335e - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: renesas_usbhs: Borrar la función notify_hotplug_work. Al realizar operaciones continuas de desvinculación/vinculación en los controladores USB disponibles en el SoC Renesas RZ/G2L, puede producirse un fallo del kernel con el mensaje "No se puede gestionar la desreferencia del puntero nulo del kernel en la dirección virtual". Este problema afecta a la función usbhsc_notify_hotplug(). Borre la función retrasada para evitar su ejecución cuando los recursos del controlador no estén disponibles.
First Time Linux linux Kernel
Linux

01 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 16:15

Updated : 2025-04-11 13:16

NVD link : CVE-2025-21917

Mitre link : CVE-2025-21917

CVE.ORG link : CVE-2025-21917

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference