LiveActive security incident?Get immediate response
CVE Record

CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix accessing freed irq affinity_hint In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(). This value is stored in irq_desc->affinity_hint, but once stmmac_request_irq_multi_msi() returns, the pointer becomes dangling. The affinity_hint is exposed via procfs with S_IRUGO permissions, allowing any unprivileged process to read it. Accessing this stale pointer can lead to: - a kernel oops or panic if the referenced memory has been released and unmapped, or - leakage of kernel data into userspace if the memory is re-used for other purposes. All platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are affected.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, unprivileged user on an affected Linux system could trigger access to stale kernel memory through a publicly readable procfs interface. The result may be sensitive kernel-data exposure or a system crash. Exposure is limited to systems using the stmmac network driver with PCI MSI.

Executive priority

Treat as a high-priority local vulnerability on exposed systems, especially shared or multi-user infrastructure. It is not described as remotely exploitable or actively exploited, so prioritize verified stmmac-plus-PCI-MSI exposure ahead of broad emergency action.

Technical view

stmmac_request_irq_multi_msi() passes a stack-based cpu_mask to irq_set_affinity_hint(). The kernel retains that pointer after the function returns, creating a dangling affinity_hint exposed through procfs. Later reads may disclose reused kernel memory or cause an oops or panic. CVSS 3.1 is 7.1: local, low-complexity, low-privilege exploitation affecting confidentiality and availability.

Likely exposure

Linux hosts using stmmac networking with PCI MSI are potentially exposed, including cited Intel and Loongson platforms. Systems not using this driver and configuration are not identified as affected. The supplied version data is ambiguous, so assess vendor kernel builds by fix inclusion rather than version strings alone.

Exploitation context

The issue requires local access with low privileges and no user interaction. The bundle reports no CISA KEV listing and provides no evidence of active exploitation. It could cause kernel-data disclosure or denial of service, but integrity impact is not identified.

Researcher notes

The source identifies a stack-use-after-return condition involving irq_desc->affinity_hint. Six stable-kernel fix commits are supplied, but the bundle does not map each commit to a branch or clearly define fixed version boundaries. Validate backports using vendor build metadata or commit inclusion; do not rely solely on the listed versions.

Mitigation direction

  • Update to a vendor-supported kernel build containing the applicable referenced stable fix.
  • Consult the Linux distribution or appliance vendor for exact fixed package versions.
  • Prioritize multi-user, shared-hosting, and other systems permitting untrusted local processes.
  • Where updating is delayed, restrict untrusted local access as a temporary risk reduction.

Validation and detection

  • Identify hosts using the stmmac network driver with PCI MSI enabled.
  • Compare each running kernel build against vendor advisories and referenced stable commits.
  • Confirm the remediated kernel is running after installation and reboot.
  • Review kernel logs for unexplained oops, panic, or stmmac-related failures.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-23155 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2025-23155Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8deec94c6040bb4a767f6e9456a0a44c7f2e713e, 8deec94c6040bb4a767f6e9456a0a44c7f2e713e, 8deec94c6040bb4a767f6e9456a0a44c7f2e713e, 8deec94c6040bb4a767f6e9456a0a44c7f2e713e, 8deec94c6040bb4a767f6e9456a0a44c7f2e713e, 8deec94c6040bb4a767f6e9456a0a44c7f2e713eunaffected
LinuxLinux5.13, 0, 6.1.164, 6.6.117, 6.12.36, 6.13.12, 6.14.3, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.