CVE-2025-23155

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Fix accessing freed irq affinity_hint

In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(). This value is stored in irq_desc->affinity_hint, but once stmmac_request_irq_multi_msi() returns, the pointer becomes dangling.

The affinity_hint is exposed via procfs with S_IRUGO permissions, allowing any unprivileged process to read it. Accessing this stale pointer can lead to:

• a kernel oops or panic if the referenced memory has been released and unmapped, or
• leakage of kernel data into userspace if the memory is re-used for other purposes.

All platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are affected.

This vulnerability does not affect Red Hat Enterprise Linux or other Red Hat products because the vulnerable code in the Synopsys DesignWare Ethernet QoS (stmmac) driver is not present in Red Hat kernels. The upstream issue involves improper handling of interrupt affinity masks during multi-MSI vector configuration on hardware utilizing the stmmac network controller, which could allow a local user to cause a denial of service or read uninitialized memory via the procfs interface. Because supported Red Hat kernel trees do not include the offending implementation, Red Hat environments remain unaffected by this flaw.