CVE-2025-21840

thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header

published March 7, 2025

CVSS
—
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header

The intel-lpmd tool [1], which uses the THERMAL_GENL_ATTR_CPU_CAPABILITY

attribute to receive HFI events from kernel space, encounters a

segmentation fault after commit 1773572863c4 ("thermal: netlink: Add the

commands and the events for the thresholds").

The issue arises because the THERMAL_GENL_ATTR_CPU_CAPABILITY raw value

was changed while intel_lpmd still uses the old value.

Although intel_lpmd can be updated to check the THERMAL_GENL_VERSION and

use the appropriate THERMAL_GENL_ATTR_CPU_CAPABILITY value, the commit

itself is questionable.

The commit introduced a new element in the middle of enum thermal_genl_attr,

which affects many existing attributes and introduces potential risks

and unnecessary maintenance burdens for userspace thermal netlink event

users.

Solve the issue by moving the newly introduced

THERMAL_GENL_ATTR_TZ_PREV_TEMP attribute to the end of the

enum thermal_genl_attr. This ensures that all existing thermal generic

netlink attributes remain unaffected.

[ rjw: Subject edits ]

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.4th percentile
Published
2025-03-07T09:09Z
EPSS history
Timeline
  • 07 MAR 09:09Z
    thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header
    cvelistv5