CVE-2025-21810

In the Linux kernel, the following vulnerability has been resolved:

driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()

There are a potential wild pointer dereferences issue regarding APIs class_dev_iter_(init|next|exit)(), as explained by below typical usage:

// All members of @iter are wild pointers. struct class_dev_iter iter;

// class_dev_iter_init(@iter, @class, ...) checks parameter @class for // potential class_to_subsys() error, and it returns void type and does // not initialize its output parameter @iter, so caller can not detect // the error and continues to invoke class_dev_iter_next(@iter) even if // @iter still contains wild pointers. class_dev_iter_init(&iter, ...);

// Dereference these wild pointers in @iter here once suffer the error. while (dev = class_dev_iter_next(&iter)) { ... };

// Also dereference these wild pointers here. class_dev_iter_exit(&iter);

Actually, all callers of these APIs have such usage pattern in kernel tree. Fix by:

• Initialize output parameter @iter by memset() in class_dev_iter_init() and give callers prompt by pr_crit() for the error.
• Check if @iter is valid in class_dev_iter_next().

A flaw of low impact was found in the Linux kernel driver core, in the class_dev_iter_init()/class_dev_iter_next()/class_dev_iter_exit() APIs. class_dev_iter_init() returns void and does not initialize its output iterator when the internal class_to_subsys() conversion of the supplied class fails, so a caller cannot detect the error and proceeds to dereference the uninitialized (wild) iterator pointers in class_dev_iter_next() and class_dev_iter_exit(). Exploiting this bug requires local access and hitting a rare class initialization error path; the worst realistic outcome is a kernel crash, i.e. a local denial of service with no confidentiality or integrity impact. This is reflected in the Red Hat CVSS score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which matches the NIST score, while the higher 7.8 score in the upstream CVE record assumes high confidentiality and integrity impact that the technical evidence does not support. Red Hat Enterprise Linux 8 is not affected because the issue was introduced upstream in Linux kernel 6.4, which is newer than the RHEL 8 kernel base. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS are affected; as a low-severity error-path robustness issue whose worst case is a local denial of service, fixes for these streams have been deferred to a future scheduled kernel update, and the residual risk of that deferral is limited to a potential kernel crash on affected systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.