CVE-2025-21799— net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
Affected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 93a76530316a3d8cc2d82c3deca48424fee92100< 321990fdf4f1bb64e818c7140688bf33d129e48d | affected |
93a76530316a3d8cc2d82c3deca48424fee92100< ed8c0300f302338c36edb06bca99051e5be6fb2f | affected | ||
93a76530316a3d8cc2d82c3deca48424fee92100< aea5cca681d268f794fa2385f9ec26a5cce025cd | affected | ||
93a76530316a3d8cc2d82c3deca48424fee92100< 88fd5db8c0073bd91d18391feb5741aeb0a2b475 | affected | ||
93a76530316a3d8cc2d82c3deca48424fee92100< 8448c87b3af68bebca21e3136913f7f77e363515 | affected | ||
93a76530316a3d8cc2d82c3deca48424fee92100< 8aae91ae1c65782a169ec070e023d4d269e5d6e6 | affected | ||
93a76530316a3d8cc2d82c3deca48424fee92100< 4395a44acb15850e492dd1de9ec4b6479d96bc80 | affected | ||
5.7 | affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-21799
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns negative error value on error. So not NULL check is not sufficient to deteremine if IRQ is valid. Check that IRQ is greater then zero to ensure it is valid. There is no issue at probe time but at runtime user can invoke .set_channels which results in the following call chain. am65_cpsw_set_channels() am65_cpsw_nuss_update_tx_rx_chns() am65_cpsw_nuss_remove_tx_chns() am65_cpsw_nuss_init_tx_chns() At this point if am65_cpsw_nuss_init_tx_chns() fails due to k3_udma_glue_tx_get_irq() then tx_chn->irq will be set to a negative value. Then, at subsequent .set_channels with higher channel count we will attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns() leading to a kernel warning. The issue is present in the original commit that introduced this driver, although there, am65_cpsw_nuss_update_tx_rx_chns() existed as am65_cpsw_nuss_update_tx_chns().
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未正确处理IRQ释放，可能导致无效IRQ释放。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-21799
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-21799
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-02-27 · 177 CVEs total
| CVE-2025-21756 | 7.8 HIGH | vsock: Keep the binding until socket destruction |
| CVE-2025-21770 | iommu: Fix potential memory leak in iopf_queue_remove_device() | |
| CVE-2025-21761 | openvswitch: use RCU protection in ovs_vport_cmd_fill_info() | |
| CVE-2025-21763 | neighbour: use RCU protection in __neigh_notify() | |
| CVE-2025-21762 | arp: use RCU protection in arp_xmit() | |
| CVE-2025-21764 | ndisc: use RCU protection in ndisc_alloc_skb() | |
| CVE-2025-21765 | ipv6: use RCU protection in ip6_default_advmss() | |
| CVE-2025-21766 | ipv4: use RCU protection in __ip_rt_update_pmtu() | |
| CVE-2025-21767 | clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context | |
| CVE-2025-21769 | ptp: vmclock: Add .owner to vmclock_miscdev_fops | |
| CVE-2025-21768 | net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels | |
| CVE-2025-21771 | sched_ext: Fix incorrect autogroup migration detection | |
| CVE-2025-21776 | USB: hub: Ignore non-compliant devices with too many configs or interfaces | |
| CVE-2025-21781 | batman-adv: fix panic during interface removal | |
| CVE-2025-21780 | drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() | |
| CVE-2025-21779 | KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel | |
| CVE-2025-21778 | tracing: Do not allow mmap() of persistent ring buffer | |
| CVE-2025-21777 | ring-buffer: Validate the persistent meta data subbuf array | |
| CVE-2025-21775 | can: ctucanfd: handle skb allocation failure | |
| CVE-2025-21773 | can: etas_es58x: fix potential NULL pointer dereference on udev->serial |
Showing top 20 of 177 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
Same vendor: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
V. Comments for CVE-2025-21799
No comments yet