What is the CVSS score of CVE-2025-23155?

CVE-2025-23155 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux are affected by CVE-2025-23155?

CVE-2025-23155 presents moderate security risk rated CVSS 5.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-23155?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Linux CVE-2025-23155

MEDIUM

2025-05-01 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Intel

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

May 01, 2025 - 13:15 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Fix accessing freed irq affinity_hint

In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(). This value is stored in irq_desc->affinity_hint, but once stmmac_request_irq_multi_msi() returns, the pointer becomes dangling.

The affinity_hint is exposed via procfs with S_IRUGO permissions, allowing any unprivileged process to read it. Accessing this stale pointer can lead to:

a kernel oops or panic if the referenced memory has been released and

unmapped, or

leakage of kernel data into userspace if the memory is re-used for

other purposes.

All platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are affected.

AnalysisAI

A use-after-free vulnerability exists in the Linux kernel's stmmac network driver affecting the MSI interrupt affinity hint mechanism. An unprivileged local attacker can read a dangling kernel pointer exposed via procfs (with S_IRUGO permissions), potentially causing kernel panics or leaking sensitive kernel data into userspace. The vulnerability affects all platforms using stmmac with PCI MSI support (Intel, Loongson, etc.), with an EPSS score of 0.11% and patches available from kernel maintainers.

Technical ContextAI

The vulnerability resides in the stmmac driver's stmmac_request_irq_multi_msi() function, which passes a pointer to a stack-allocated cpu_mask variable to irq_set_affinity_hint(). This pointer is stored in the irq_desc structure's affinity_hint field, but becomes a dangling pointer once the function returns and the stack frame is destroyed. The affinity_hint is subsequently exposed to unprivileged users via procfs with standard read permissions (S_IRUGO = 0444), allowing arbitrary local processes to dereference this stale pointer. This is classified as a use-after-free (CWE-416) vulnerability affecting the stmmac Ethernet MAC driver across platforms implementing PCI MSI interrupts. The affected Linux kernel versions are identified via CPE (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*).

RemediationAI

Apply the available kernel patches immediately by upgrading to the latest stable kernel version incorporating the stmmac affinity_hint fix; patches are available via https://git.kernel.org/stable/ with the referenced commit hashes. The fix reallocates the cpu_mask variable to persistent kernel memory (e.g., via kmalloc) rather than stack memory, ensuring the affinity_hint pointer remains valid throughout the device lifecycle. For systems unable to immediately patch, restrict access to /proc/irq/*/affinity_hint via AppArmor or SELinux policies to prevent unprivileged reads, or disable MSI support in stmmac if operationally feasible. Verify patch application by checking kernel version and confirming commit hashes are present in the running kernel.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31