NetSight
IP …
high7.8

CVE-2025-21715

In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it cannot be used …

Impact

In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it cannot be used after free_netdev() call. Using dm after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function. This is similar to the issue fixed in commit ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove"). This bug is detected by our static analysis tool.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.4.262 before 4.5
from 4.9.262 before 4.10
from 4.14.226 before 4.15
from 4.19.181 before 4.20
from 5.4.106 before 5.4.291
from 5.10.24 before 5.10.235

Weakness classification

CWE-416

References