CVE-2025-21840

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header

The intel-lpmd tool [1], which uses the THERMAL_GENL_ATTR_CPU_CAPABILITY

attribute to receive HFI events from kernel space, encounters a

segmentation fault after commit 1773572863c4 ("thermal: netlink: Add the

commands and the events for the thresholds").

The issue arises because the THERMAL_GENL_ATTR_CPU_CAPABILITY raw value

was changed while intel_lpmd still uses the old value.

Although intel_lpmd can be updated to check the THERMAL_GENL_VERSION and

use the appropriate THERMAL_GENL_ATTR_CPU_CAPABILITY value, the commit

itself is questionable.

The commit introduced a new element in the middle of enum thermal_genl_attr,

which affects many existing attributes and introduces potential risks

and unnecessary maintenance burdens for userspace thermal netlink event

users.

Solve the issue by moving the newly introduced

THERMAL_GENL_ATTR_TZ_PR

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References