CVE-2025-21810: driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()
In the Linux kernel, the following vulnerability has been resolved:
driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()
There are a potential wild pointer dereferences issue regarding APIs
class_dev_iter_(init|next|exit)(), as explained by below typical usage:
// All members of @iter are wild pointers.
struct class_dev_iter iter;
// class_dev_iter_init(@iter, @class, ...) checks parameter @class for
// potential class_to_subsys() error, and it returns void type and does
// not initialize its output parameter @iter, so caller can not detect
// the error and continues to invoke class_dev_iter_next(@iter) even if
// @iter still contains wild pointers.
class_dev_iter_init(&iter, ...);
// Dereference these wild pointers in @iter here once suffer the error.
while (dev = class_dev_iter_next(&iter)) { ... };
// Also dereference these wild pointers here.
class_dev_iter_exit(&iter);
Actually, all callers of these APIs have such usage pattern in kernel tree.
Fix by:
- Initialize output parameter @iter by memset() in class_dev_iter_init()
and give callers prompt by pr_crit() for the error.
- Check if @iter is valid in class_dev_iter_next().
Security readout for executives and security teams
Plain-English summary
CVE-2025-21810 is a Linux kernel driver core bug where failed class iterator initialization can leave internal pointers uninitialized, and later calls may dereference them. The public record does not provide CVSS, CWE, business impact, or confirmed exploitation. Treat it as kernel stability and safety debt until vendor or distribution guidance classifies risk.
Executive priority
Track this through normal kernel vulnerability management unless your environment runs exposed custom kernels or high-availability systems sensitive to kernel crashes. Urgency is uncertain because the public sources provide no CVSS, no KEV listing, and no confirmed exploitation.
Technical view
The flaw is in class_dev_iter_init(), class_dev_iter_next(), and class_dev_iter_exit(). If class_dev_iter_init() encounters a class_to_subsys() error, it returns void without initializing the iterator, leaving wild pointers that later API calls may dereference. The fix initializes the iterator with memset(), logs a critical error, and validates the iterator in class_dev_iter_next().
Likely exposure
Exposure is limited to systems running affected Linux kernel versions or downstream kernels carrying the vulnerable driver core code. The source bundle lists Linux as affected, but does not map exposure to distributions, appliances, cloud images, or vendor-specific kernel packages.
Exploitation context
The bundle does not identify active exploitation, public exploit code, attacker prerequisites, or a practical attack path. KEV is false. Evidence supports a kernel bug involving unsafe pointer dereference, but not confirmed remote or local exploitability.
Researcher notes
Key uncertainty is exploitability. The record describes a defensive fix for iterator initialization and validation, but not an attacker-controlled path to trigger class_to_subsys() failure. Review downstream patches and call sites if assessing crashability or privilege impact.
Mitigation direction
Check your Linux distribution advisories for CVE-2025-21810 packages.
Prioritize kernel updates where vendor fixes include the referenced stable commits.
Avoid assuming upstream version numbers match downstream vendor backports.
Schedule reboots or live-patching according to normal kernel patch procedures.
Validation and detection
Inventory Linux kernel versions across servers, containers hosts, and appliances.
Compare installed kernels against vendor advisories for CVE-2025-21810.
Confirm whether fixes reference the listed upstream stable commits.
Monitor kernel logs for critical driver core messages after patching.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-21810 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
5Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Feb 27, 2025, 20:01 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.