CVE-2025-21943

Summary

CVE-2025-21943 is a vulnerability affecting the Linux kernel's gpio subsystem. A race condition occurs when module handlers for gpio-aggregator do not properly hold references to global resources during device registration and deletion. This can result in issues such as list corruption and system instability. A simple reproducer demonstrates these problems, leading to warnings and potential system instability. The vulnerability is addressed by adding try_module_get() to the handlers to prevent module unload while the device is being registered or deleted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.