Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access. Make sure that all resources have been set up before registering the efivars.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 6.11, < 6.12.21 |
Related Weaknesses (CWE)
References
- https://git.kernel.org/stable/c/c4e37b381a7a243c298a4858fc0a5a74e737c79aPatch
- https://git.kernel.org/stable/c/da8d493a80993972c427002684d0742560f3be4aPatch
- https://git.kernel.org/stable/c/f15a2b96a0e41c426c63a932d0e63cde7b9784aaPatch
FAQ
What is CVE-2025-21998?
CVE-2025-21998 is a vulnerability with a CVSS score of 4.7 (MEDIUM). In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is r...
How severe is CVE-2025-21998?
CVE-2025-21998 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-21998?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.