LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21799: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns negative error value on error. So not NULL check is not sufficient to deteremine if IRQ is valid. Check that IRQ is greater then zero to ensure it is valid. There is no issue at probe time but at runtime user can invoke .set_channels which results in the following call chain. am65_cpsw_set_channels() am65_cpsw_nuss_update_tx_rx_chns() am65_cpsw_nuss_remove_tx_chns() am65_cpsw_nuss_init_tx_chns() At this point if am65_cpsw_nuss_init_tx_chns() fails due to k3_udma_glue_tx_get_irq() then tx_chn->irq will be set to a negative value. Then, at subsequent .set_channels with higher channel count we will attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns() leading to a kernel warning. The issue is present in the original commit that introduced this driver, although there, am65_cpsw_nuss_update_tx_rx_chns() existed as am65_cpsw_nuss_update_tx_chns().

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver bug in the TI am65-cpsw Ethernet path. A failed IRQ lookup can later cause the kernel to try freeing an invalid IRQ, producing a kernel warning during runtime channel changes. The sources do not show data theft, remote exploitation, or privilege escalation.

Executive priority

Treat this as a targeted kernel maintenance issue, not an emergency. Prioritize patching embedded or appliance-like Linux systems using this Ethernet driver, especially where network channel settings are adjusted operationally.

Technical view

The am65-cpsw driver used a non-NULL check for an IRQ value returned by k3_udma_glue_tx_get_irq(), although errors are negative values. A failed transmit-channel initialization can store a negative IRQ; a later set_channels operation with a higher channel count can free that invalid IRQ and trigger a warning.

Likely exposure

Exposure appears limited to Linux systems running affected kernels with the am65-cpsw Ethernet driver path in use. It is most relevant to systems where runtime channel configuration is performed. Generic Linux servers without this driver or hardware path are unlikely to be exposed.

Exploitation context

The source states the issue is reachable through runtime .set_channels handling. It does not cite public exploitation, KEV listing, remote attackability, or a practical security impact beyond a kernel warning. KEV status is false in the provided bundle.

Researcher notes

Evidence supports a driver-specific error-handling flaw and kernel warning path. The bundle lacks CVSS, CWE, exploit evidence, and broader impact analysis. Do not assume remote exploitability or privilege escalation without additional vendor or kernel maintainer evidence.

Mitigation direction

  • Update to a kernel containing the referenced stable fixes.
  • Apply relevant Debian LTS kernel updates where Debian packages are used.
  • Prioritize systems using the am65-cpsw Ethernet driver.
  • Avoid unnecessary runtime channel-count changes until patched.
  • Check vendor kernel guidance for downstream or embedded builds.

Validation and detection

  • Inventory Linux kernel versions on potentially affected systems.
  • Confirm whether the am65-cpsw driver is present and used.
  • Review change history for runtime channel configuration use.
  • Verify installed kernels include the relevant stable fix.
  • Check Debian LTS advisory applicability for Debian deployments.
Prepared
Confidence
medium
Sources
11

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21799 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux93a76530316a3d8cc2d82c3deca48424fee92100, 93a76530316a3d8cc2d82c3deca48424fee92100, 93a76530316a3d8cc2d82c3deca48424fee92100, 93a76530316a3d8cc2d82c3deca48424fee92100, 93a76530316a3d8cc2d82c3deca48424fee92100, 93a76530316a3d8cc2d82c3deca48424fee92100, 93a76530316a3d8cc2d82c3deca48424fee92100unaffected
LinuxLinux5.7, 0, 5.10.235, 5.15.179, 6.1.129, 6.6.76, 6.12.13, 6.13.2, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.