Device Release Function Issue in Linux Kernel Affects System Stability

CVE-2025-21856

Summary

A vulnerability in the Linux kernel relates to the management of device structures where the absence of a proper release function can lead to stability issues. When a device is added through device_add(), the current implementation directly frees the device without waiting for other kernel components to release their references. This behavior can result in lingering references, for instance in sysfs, potentially leading to use-after-free vulnerabilities if the device does not have an appropriate release function defined. Therefore, ensuring the correct implementation of device management is crucial to maintain overall system integrity.

References