CVE-2025-21943

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

gpio: aggregator: protect driver attr handlers against module unload

Both new_device_store and delete_device_store touch module global

resources (e.g. gpio_aggregator_lock). To prevent race conditions with

module unload, a reference needs to be held.

Add try_module_get() in these handlers.

For new_device_store, this eliminates what appears to be the most dangerous

scenario: if an id is allocated from gpio_aggregator_idr but

platform_device_register has not yet been called or completed, a concurrent

module unload could fail to unregister/delete the device, leaving behind a

dangling platform device/GPIO forwarder. This can result in various issues.

The following simple reproducer demonstrates these problems:

#!/bin/bash

while :; do

# note: whether 'gpiochip0 0' exists or not does not matter.

echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device

done &

while :; do

modprobe gpio

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References