In the Linux kernel, the following vulnerability has been resolved:
gpio: aggregator: protect driver attr handlers against module unload
Both newdevicestore and deletedevicestore touch module global resources (e.g. gpioaggregatorlock). To prevent race conditions with module unload, a reference needs to be held.
Add trymoduleget() in these handlers.
For newdevicestore, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpioaggregatoridr but platformdeviceregister has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems:
#!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait
Starting with the following warning, several kinds of warnings will appear and the system may become unstable:
------------[ cut here ]------------ listdel corruption, ffff888103e2e980->next is LISTPOISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/listdebug.c:56 listdelentryvalidorreport+0xa3/0x120 [...] RIP: 0010:listdelentryvalidorreport+0xa3/0x120 [...] Call Trace: <TASK> ? _listdelentryvalidorreport+0xa3/0x120 ? _warn.cold+0x93/0xf2 ? _listdelentryvalidorreport+0xa3/0x120 ? reportbug+0xe6/0x170 ? _irqworkqueuelocal+0x39/0xe0 ? handlebug+0x58/0x90 ? excinvalidop+0x13/0x60 ? asmexcinvalidop+0x16/0x20 ? _listdelentryvalidorreport+0xa3/0x120 gpiodremovelookuptable+0x22/0x60 newdevicestore+0x315/0x350 [gpioaggregator] kernfsfopwriteiter+0x137/0x1f0 vfswrite+0x262/0x430 ksyswrite+0x60/0xd0 dosyscall64+0x6c/0x180 entrySYSCALL64afterhwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]---
[
{
"id": "CVE-2025-21943-100a8df0",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117",
"target": {
"function": "delete_device_store",
"file": "drivers/gpio/gpio-aggregator.c"
},
"digest": {
"length": 475.0,
"function_hash": "168782698226603917489238996997729275659"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-21943-44fbec84",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117",
"target": {
"function": "new_device_store",
"file": "drivers/gpio/gpio-aggregator.c"
},
"digest": {
"length": 1314.0,
"function_hash": "206684420409729188802616763975870989856"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-21943-5e1a94ff",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12f65d1203507f7db3ba59930fe29a3b8eee9945",
"target": {
"function": "new_device_store",
"file": "drivers/gpio/gpio-aggregator.c"
},
"digest": {
"length": 1314.0,
"function_hash": "206684420409729188802616763975870989856"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-21943-937ef5a9",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12f65d1203507f7db3ba59930fe29a3b8eee9945",
"target": {
"function": "delete_device_store",
"file": "drivers/gpio/gpio-aggregator.c"
},
"digest": {
"length": 475.0,
"function_hash": "168782698226603917489238996997729275659"
},
"signature_type": "Function"
},
{
"id": "CVE-2025-21943-d640d818",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117",
"target": {
"file": "drivers/gpio/gpio-aggregator.c"
},
"digest": {
"line_hashes": [
"209900746946584030932432411977405906675",
"249088714974385490549818340204798761747",
"324501823046771949006468346913474675322",
"233937899175889185512103954515450045442",
"131510507707613071717361781331847939786",
"307978612158351606333858075396388382801",
"40264546728824047946700569222034130773",
"255457276131573580026732062564374489964",
"45609671893744197039334266081299640017",
"137871130802538678276278663166493249026",
"278417543925686247294500461563834983415",
"191700445709798159500692357493665065038",
"326572097925246626820502127217015728000",
"2413019065590676161115786434659015136",
"227355174714169091891458146942859319738",
"313923166474739290912996991593833913725",
"11318187126432963074841254632113650538",
"187858187909513567808950181984637026912",
"226015601960327442058636090426671403257",
"200436413516255603647347696179274618761",
"25598717588385458234693617558740330301",
"309618132280646697486833422200266156883",
"208794054543232578925910235607770897669"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2025-21943-e02159c7",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12f65d1203507f7db3ba59930fe29a3b8eee9945",
"target": {
"file": "drivers/gpio/gpio-aggregator.c"
},
"digest": {
"line_hashes": [
"209900746946584030932432411977405906675",
"249088714974385490549818340204798761747",
"324501823046771949006468346913474675322",
"233937899175889185512103954515450045442",
"131510507707613071717361781331847939786",
"307978612158351606333858075396388382801",
"40264546728824047946700569222034130773",
"255457276131573580026732062564374489964",
"45609671893744197039334266081299640017",
"137871130802538678276278663166493249026",
"278417543925686247294500461563834983415",
"191700445709798159500692357493665065038",
"326572097925246626820502127217015728000",
"2413019065590676161115786434659015136",
"227355174714169091891458146942859319738",
"313923166474739290912996991593833913725",
"11318187126432963074841254632113650538",
"187858187909513567808950181984637026912",
"226015601960327442058636090426671403257",
"200436413516255603647347696179274618761",
"25598717588385458234693617558740330301",
"309618132280646697486833422200266156883",
"208794054543232578925910235607770897669"
],
"threshold": 0.9
},
"signature_type": "Line"
}
]