What’s Vulnerable › Vulnerabilities

CVE-2025-21950: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-01 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", which are then copied to user space. The initializer is indeed implemented in "acrn_hypercall2" (arch/x86/include/asm/acrn.h). There is a risk of information leakage due to uninitialized bytes.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 5.12 before 5.15.179; from 5.16 before 6.1.131; from 6.2 before 6.6.83; from 6.7 before 6.12.19; from 6.13 before 6.13.7; 6.14-rc1, 6.14-rc2, 6.14-rc3, 6.14-rc4, 6.14-rc5 — fixed in 5.15.179, 6.1.131, 6.12.19, 6.13.7, 6.6.83

How to fix

Upgrade to a fixed version: Linux kernel 5.15.179, 6.1.131, 6.12.19, 6.13.7. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1b8f7a2caa7f9cdfd135e3f78eb9d7e36fb95083
• https://git.kernel.org/stable/c/4e15cf870d2c748e45d45ffc4d5b1dc1b7d50120
• https://git.kernel.org/stable/c/524f29d78c9bdeb49f31f5b0376a07d2fc5cf563
• https://git.kernel.org/stable/c/819cec1dc47cdeac8f5dd6ba81c1dbee2a68c3bb
• https://git.kernel.org/stable/c/a4c21b878f0e237f45209a324c903ea7fb05247d
• https://git.kernel.org/stable/c/d7e5031fe3f161c8eb5e84db1540bc4373ed861b
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Get alerted when CVE-2025-21950 or the next vulnerability affects your stack