CVE-2025-23155

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Fix accessing freed irq affinity_hint

In stmmacrequestirqmultimsi(), a pointer to the stack variable cpumask is passed to irqsetaffinityhint(). This value is stored in irqdesc->affinityhint, but once stmmacrequestirqmultimsi() returns, the pointer becomes dangling.

The affinityhint is exposed via procfs with SIRUGO permissions, allowing any unprivileged process to read it. Accessing this stale pointer can lead to:

• a kernel oops or panic if the referenced memory has been released and unmapped, or
• leakage of kernel data into userspace if the memory is re-used for other purposes.

All platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are affected.