CVE-2025-21715
net: davicom: fix UAF in dm9000_drv_remove
Reported by linux · Published February 27, 2025
In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it cannot be used after free_netdev() call. Using dm after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function. This is similar to the issue fixed in commit ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove"). This bug is detected by our static analysis tool.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Linux | Linux | db79e982c5f9e39ab710cbce55b05f2f5e6f1ca9, c94ab07edc2843e2f3d46dbd82e5c681503aaadf, c411f9a5fdc9158e8f7c57eac961d3df3eb4d8ca, a53cb72043443ac787ec0b5fa17bb3f8ff3d462b, 7d7d201eb3b766abe590ac0dda7a508b7db3e357, 5a54367a7c2378c65aaa4d3cfd952f26adef7aa7, 5.12, 5.10.235, 5.4.291, 4.20, 4.15, 4.10, 4.5, 2013c95df6752d9c88221d0f0f37b6f197969390, 19e65c45a1507a1a2926649d2db3583ed9d55fd9 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | d28e783c20033b90a64d4e1307bafb56085d8184, 4fd0654b8f2129b68203974ddee15f804ec011c2, cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b |
| Linux | Linux | 5.12, 0, 5.4.291 |
| Linux | Linux | 5.11.7, *, 4fd0654b8f2129b68203974ddee15f804ec011c2 |
| linux | linux_kernel | 5.12, 5.12, 5.12 |
Timeline
- Feb 26, 2025 CVE Published
- Feb 27, 2025 EPSS Score (30 in total, the first dated here)
- Feb 28, 2025 Coalition ESS Score (27 in total, the first dated here)
- Dec 22, 2025 Security Advisory (405 in total, the first dated here)
- Jan 14, 2026 PoC Published
- Mar 30, 2026 Distribution Patch (359 in total, the first dated here)
- Nov 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-21715
vulnetix vdb fixes CVE-2025-21715Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-21715/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart