In the Linux kernel, the following vulnerability has been resolved:

zram: fix potential UAF of zram table

If zram_meta_alloc failed early, it frees allocated zram->table without
setting it NULL. Which will potentially cause zram_meta_free to access
the table if user reset an failed and uninitialized device.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00036.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

No data.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4076-1 linux-6.1 security update
EUVD EUVD EUVD-2025-2620 In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table if user reset an failed and uninitialized device.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/212fe1c0df4a150fb6298db2cfff267ceaba5402 cve-icon cve-icon
https://git.kernel.org/stable/c/571d3f6045cd3a6d9f6aec33b678f3ffe97582ef cve-icon cve-icon
https://git.kernel.org/stable/c/902ef8f16d5ca77edc77c30656be54186c1e99b7 cve-icon cve-icon
https://git.kernel.org/stable/c/fe3de867f94819ba0f28e035c0b0182150147d95 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html cve-icon
https://lore.kernel.org/linux-cve-announce/2025013159-CVE-2025-21671-c4b0@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-21671 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-21671 cve-icon
History

Mon, 03 Nov 2025 21:30:00 +0000

Type Values Removed Values Added
References

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00017}

 epss

{'score': 0.00026}

Mon, 10 Feb 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Feb 2025 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Sat, 01 Feb 2025 02:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 31 Jan 2025 11:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table if user reset an failed and uninitialized device.
Title zram: fix potential UAF of zram table
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-11-03T20:58:51.664Z

Reserved: 2024-12-29T08:45:45.735Z

Link: CVE-2025-21671

cve-icon Vulnrichment

Updated: 2025-02-10T17:11:52.482Z

cve-icon NVD

Status : Modified

Published: 2025-01-31T12:15:28.263

Modified: 2025-11-03T21:19:05.657

Link: CVE-2025-21671

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-01-31T00:00:00Z

Links: CVE-2025-21671 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses