Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-21943— gpio: aggregator: protect driver attr handlers against module unload

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于gpio聚合器驱动属性处理程序存在模块卸载竞态条件。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1564.004 · NTFS File Attributes

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 828546e24280f721350a7a0dcc92416e917b4382< fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117 affected
828546e24280f721350a7a0dcc92416e917b4382< 807789018186cf508ceb3a1f8f02935cd195717b affected
828546e24280f721350a7a0dcc92416e917b4382< 9334c88fc2fbc6836b307d269fcc1744c69701c0 affected
828546e24280f721350a7a0dcc92416e917b4382< d99dc8f7ea01ee1b21306e0eda8eb18a4af80db6 affected
828546e24280f721350a7a0dcc92416e917b4382< 8fb07fb1bba91d45846ed8605c3097fe67a7d54c affected
828546e24280f721350a7a0dcc92416e917b4382< 56281a76b805b5ac61feb5d580139695a22f87f0 affected
828546e24280f721350a7a0dcc92416e917b4382< 12f65d1203507f7db3ba59930fe29a3b8eee9945 affected
5.8 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21943

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
gpio: aggregator: protect driver attr handlers against module unload
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: protect driver attr handlers against module unload Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held. Add try_module_get() in these handlers. For new_device_store, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpio_aggregator_idr but platform_device_register has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems: #!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait Starting with the following warning, several kinds of warnings will appear and the system may become unstable: ------------[ cut here ]------------ list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 [...] RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 [...] Call Trace: <TASK> ? __list_del_entry_valid_or_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __list_del_entry_valid_or_report+0xa3/0x120 ? report_bug+0xe6/0x170 ? __irq_work_queue_local+0x39/0xe0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? __list_del_entry_valid_or_report+0xa3/0x120 gpiod_remove_lookup_table+0x22/0x60 new_device_store+0x315/0x350 [gpio_aggregator] kernfs_fop_write_iter+0x137/0x1f0 vfs_write+0x262/0x430 ksys_write+0x60/0xd0 do_syscall_64+0x6c/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于gpio聚合器驱动属性处理程序存在模块卸载竞态条件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 828546e24280f721350a7a0dcc92416e917b4382 ~ fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117 -
Linux Linux 5.8 -

II. Public POCs for CVE-2025-21943

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21943

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21943 (3)

Same Patch Batch · Linux · 2025-04-01 · 93 CVEs total

CVE-2025-21954 9.8 CRITICAL netmem: prevent TX of unreadable skbs
CVE-2025-21927 9.8 CRITICAL nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
CVE-2025-21955 8.8 HIGH ksmbd: prevent connection release during oplock break notification
CVE-2025-21946 8.8 HIGH ksmbd: fix out-of-bounds in parse_sec_desc()
CVE-2025-21945 8.8 HIGH ksmbd: fix use-after-free in smb2_lock
CVE-2025-21969 8.8 HIGH Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
CVE-2025-21967 8.8 HIGH ksmbd: fix use-after-free in ksmbd_free_work_struct
CVE-2025-21972 8.8 HIGH net: mctp: unshare packets when reassembling
CVE-2025-21947 8.1 HIGH ksmbd: fix type confusion via race condition when using ipc_msg_send_request
CVE-2025-21896 7.8 HIGH fuse: revert back to __readahead_folio() for readahead
CVE-2025-21971 7.8 HIGH net_sched: Prevent creation of classes with TC_H_ROOT
CVE-2025-21899 7.8 HIGH tracing: Fix bad hist from corrupting named_triggers list
CVE-2025-21979 7.8 HIGH wifi: cfg80211: cancel wiphy_work before freeing wiphy
CVE-2025-21926 7.8 HIGH net: gso: fix ownership in __udp_gso_segment
CVE-2025-21966 7.8 HIGH dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
CVE-2025-21965 7.8 HIGH sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
CVE-2025-21934 7.8 HIGH rapidio: fix an API misues when rio_add_net() fails
CVE-2025-21939 7.8 HIGH drm/xe/hmm: Don't dereference struct page pointers without notifier lock
CVE-2025-21958 7.8 HIGH Revert "openvswitch: switch to per-action label counting in conntrack"
CVE-2025-21949 7.8 HIGH LoongArch: Set hugetlb mmap base address aligned with pmd size

Showing top 20 of 93 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21943

No comments yet

Leave a comment