CVE-2025-21856
Published: 12 March 2025
Summary
CVE-2025-21856 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-21856 is a use-after-free vulnerability (CWE-416) in the Linux kernel's s390/ism subsystem. The issue arises because the code directly frees a struct device after calling device_add() without setting a proper release function, violating kernel expectations in drivers/base/core.c. Without a release function, the device is considered broken, and lingering references—such as those from sysfs—can lead to use-after-free conditions as other kernel components may still hold pointers to the freed memory.
A local attacker with low privileges (AV:L/AC:L/PR:L) can exploit this vulnerability without user interaction (UI:N) in a single-instance context (S:U). Successful exploitation could result in high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), with a CVSS v3.1 base score of 7.8, potentially allowing arbitrary code execution or system crashes on affected s390 systems.
Mitigation involves applying upstream kernel patches, as detailed in the referenced stable commits: 0505ff2936f1 (primary fix adding the release function), along with related updates in 915e34d5ad35, 940d15254d22, and e26e8ac27351. Security practitioners should update to kernels incorporating these changes on s390 architectures to address the improper device lifecycle management.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7596
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: s390/ism: add release function for struct device According to device_release() in /drivers/base/core.c, a device without a release function is a broken device and must be fixed. The current code directly…
more
frees the device after calling device_add() without waiting for other kernel parts to release their references. Thus, a reference could still be held to a struct device, e.g., by sysfs, leading to potential use-after-free issues if a proper release function is not set.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Linux kernel (local, low-priv) enables arbitrary code execution or crashes, directly facilitating T1068 Exploitation for Privilege Escalation on s390 systems.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of flaws like the missing device release function causing use-after-free in the s390/ism kernel subsystem.
Enables vulnerability scanning to identify kernel flaws such as CVE-2025-21856 for subsequent remediation.
Implements memory protections that mitigate exploitation of use-after-free vulnerabilities by enforcing memory separation and preventing unauthorized code execution.