CVE-2025-21799: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns
negative error value on error. So not NULL check is not sufficient
to deteremine if IRQ is valid. Check that IRQ is greater then zero
to ensure it is valid.
There is no issue at probe time but at runtime user can invoke
.set_channels which results in the following call chain.
am65_cpsw_set_channels()
am65_cpsw_nuss_update_tx_rx_chns()
am65_cpsw_nuss_remove_tx_chns()
am65_cpsw_nuss_init_tx_chns()
At this point if am65_cpsw_nuss_init_tx_chns() fails due to
k3_udma_glue_tx_get_irq() then tx_chn->irq will be set to a
negative value.
Then, at subsequent .set_channels with higher channel count we
will attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns()
leading to a kernel warning.
The issue is present in the original commit that introduced this driver,
although there, am65_cpsw_nuss_update_tx_rx_chns() existed as
am65_cpsw_nuss_update_tx_chns().
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel driver bug in the TI am65-cpsw Ethernet path. A failed IRQ lookup can later cause the kernel to try freeing an invalid IRQ, producing a kernel warning during runtime channel changes. The sources do not show data theft, remote exploitation, or privilege escalation.
Executive priority
Treat this as a targeted kernel maintenance issue, not an emergency. Prioritize patching embedded or appliance-like Linux systems using this Ethernet driver, especially where network channel settings are adjusted operationally.
Technical view
The am65-cpsw driver used a non-NULL check for an IRQ value returned by k3_udma_glue_tx_get_irq(), although errors are negative values. A failed transmit-channel initialization can store a negative IRQ; a later set_channels operation with a higher channel count can free that invalid IRQ and trigger a warning.
Likely exposure
Exposure appears limited to Linux systems running affected kernels with the am65-cpsw Ethernet driver path in use. It is most relevant to systems where runtime channel configuration is performed. Generic Linux servers without this driver or hardware path are unlikely to be exposed.
Exploitation context
The source states the issue is reachable through runtime .set_channels handling. It does not cite public exploitation, KEV listing, remote attackability, or a practical security impact beyond a kernel warning. KEV status is false in the provided bundle.
Researcher notes
Evidence supports a driver-specific error-handling flaw and kernel warning path. The bundle lacks CVSS, CWE, exploit evidence, and broader impact analysis. Do not assume remote exploitability or privilege escalation without additional vendor or kernel maintainer evidence.
Mitigation direction
Update to a kernel containing the referenced stable fixes.
Apply relevant Debian LTS kernel updates where Debian packages are used.
Prioritize systems using the am65-cpsw Ethernet driver.
Avoid unnecessary runtime channel-count changes until patched.
Check vendor kernel guidance for downstream or embedded builds.
Validation and detection
Inventory Linux kernel versions on potentially affected systems.
Confirm whether the am65-cpsw driver is present and used.
Review change history for runtime channel configuration use.
Verify installed kernels include the relevant stable fix.
Check Debian LTS advisory applicability for Debian deployments.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-21799 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
1ADP providers
10Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Feb 27, 2025, 20:00 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.