API Misuse in Linux Kernel Affects Device Registration Process

CVE-2025-21934

Summary

A vulnerability has been identified in the Linux kernel related to improper handling during the device registration process. Specifically, the use of the rio_add_net() function can lead to critical errors when it calls device_register(). In scenarios where device registration fails, proper memory management is crucial; however, the function incorrectly uses kfree() instead of put_device(). This oversight can result in memory leaks or, more seriously, a use-after-free scenario if the associated device pointer is not properly cleared. Addressing this issue involves ensuring that 'mport->net' is set to NULL following a failed registration to maintain system integrity and stability.

References