VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Feb 27, 2025· Updated May 12, 2026

CVE-2025-21745

CVE-2025-21745

Description

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: Fix class @block_class's subsystem refcount leakage

blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with class_dev_iter_exit(), so causes the class's subsystem refcount leakage.

Fix by ending the iterating with class_dev_iter_exit().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing class_dev_iter_exit() in blk-cgroup causes a subsystem refcount leak that can be locally exploited to degrade system stability.

Vulnerability

In the Linux kernel, the function blkcg_fill_root_iostats() iterates over devices in @block_class using class_dev_iter_init() and class_dev_iter_next(), but fails to call class_dev_iter_exit() after the iteration completes. This omission causes a reference count leak on the class's subsystem, which over time can degrade kernel memory management and potentially lead to resource exhaustion or instability [1][2].

Exploitation

An attacker with local access and the ability to trigger I/O statistics collection can repeatedly exercise this code path. While no special privileges beyond normal user access are required to cause the leak, the vulnerability is not remotely exploitable and demands local presence on a system running an affected kernel version [3][4].

Impact

The primary impact is a slow depletion of kernel memory due to the unreleased subsystem reference, which may eventually lead to system slowdowns or denial-of-service conditions. The CVSS v3 base score of 5.5 (Medium) reflects this local availability impact. No privilege escalation or data confidentiality breach is associated with this bug.

Mitigation

The fix was committed to the Linux kernel stable tree and is included in versions that cherry-pick the patch referenced by commits ffb494f1e7a0 and 67c7f213e052 [3][4]. Users should update to a kernel containing this patch or contact their vendor for appropriate backports. Siemens has also released security advisories (SSA-082556 and SSA-265688) that list affected products and recommended updates [1][2].

References
  1. SSA-082556
  2. SSA-265688
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

138

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.