CVE-2025-21797
Published: 27 February 2025
Summary
CVE-2025-21797 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-7 (Least Functionality).
Deeper analysis
CVE-2025-21797 is a use-after-free vulnerability (CWE-416) in the Linux kernel's HID driver for Corsair Void headsets. The issue arises in the corsair_void_remove() function due to a missing cancel_delayed_work_sync() call for headset status delayed work, which can lead to a use-after-free condition. It has a CVSS v3.1 base score of 7.8 (High), with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system crashes on affected systems with the vulnerable Corsair Void HID driver loaded.
The vulnerability has been addressed in upstream Linux kernel commits, including 2dcb56a0a4da6946f6c18288da595c13e0d2af86 and 48e487b002891eb0aeaec704c9bed51f028deff1, which add the missing cancel_delayed_work_sync() call. Security practitioners should ensure systems are updated to kernel versions incorporating these stable fixes to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5133
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Add missing delayed work cancel for headset status The cancel_delayed_work_sync() call was missed, causing a use-after-free in corsair_void_remove().
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Linux kernel HID driver enables local low-privileged attacker to achieve arbitrary code execution or crashes, directly facilitating privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching of the Linux kernel to incorporate the upstream commits that add the missing cancel_delayed_work_sync() call, eliminating the use-after-free vulnerability in the corsair-void HID driver.
Reduces the attack surface by enforcing least functionality to disable or prevent loading of unnecessary kernel modules like the vulnerable Corsair Void HID driver.
Implements kernel memory protections such as address space layout randomization and guard pages that mitigate exploitation of the use-after-free condition even if the flaw remains.