CVE-2025-21914

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

slimbus: messaging: Free transaction ID in delayed interrupt scenario

In case of interrupt delay for any reason, slim_do_transfer()

returns timeout error but the transaction ID (TID) is not freed.

This results into invalid memory access inside

qcom_slim_ngd_rx_msgq_cb() due to invalid TID.

Fix the issue by freeing the TID in slim_do_transfer() before

returning timeout error to avoid invalid memory access.

Call trace:

__memcpy_fromio+0x20/0x190

qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl]

vchan_complete+0x2a0/0x4a0

tasklet_action_common+0x274/0x700

tasklet_action+0x28/0x3c

_stext+0x188/0x620

run_ksoftirqd+0x34/0x74

smpboot_thread_fn+0x1d8/0x464

kthread+0x178/0x238

ret_from_fork+0x10/0x20

Code: aa0003e8 91000429 f100044a 3940002b (3800150b)

---[ end trace 0fe00bec2b975c99 ]---

Kernel panic - not syncing: Oops: Fatal exception in interrupt.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References