CVE-2025-21998
CVSS 3.1 Score 4.7 of 10 (medium)
Details
Published Apr 3, 2025
Updated: Apr 10, 2025
CWE ID 476
CWE ID 367
Summary
CVE-2025-21998 is a vulnerability affecting the Linux kernel that has been addressed. The issue lies in the 'qcom: uefisecapp' component of the firmware, where the efivars service is registered before the memory pool has been allocated. This can result in a NULL-pointer dereference during racing EFI variable access. Consequently, it is essential to guarantee that all resources are properly set up prior to registering the efivars to prevent this vulnerability from being exploited.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Linux Kernel
Affected Vendors
- LINUX