CVE-2025-21904
CVSS 3.1 Score 5.5 of 10 (medium)
Details
Published Apr 1, 2025
Updated: Apr 15, 2025
CWE ID 476
Summary
CVE-2025-21904 is a vulnerability affecting the Linux kernel. In the `caif_virtio` driver, a wrong pointer check in the `cfv_probe()` function has been identified. Specifically, the `del_vqs()` function frees virtqueues, and the `cfv->vq_tx` pointer should be verified for NULL before being called, not `cfv->vdev`. The current implementation is redundant as `cfv->vdev` is dereferenced before being checked for NULL. To address this issue, the code has been updated to check `cfv->vq_tx` for NULL instead of `cfv->vdev` before calling `del_vqs()`.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.