CVE-2025-21999

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

proc: fix UAF in proc_get_inode()

Fix race between rmmod and /proc/XXX's inode instantiation.

The bug is that pde->proc_ops don't belong to /proc, it belongs to a

module, therefore dereferencing it after /proc entry has been registered

is a bug unless use_pde/unuse_pde() pair has been used.

use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops

never changes so information necessary for inode instantiation can be

saved _before_ proc_register() in PDE itself and used later, avoiding

pde->proc_ops->... dereference.

rmmod lookup

sys_delete_module

proc_lookup_de

pde_get(de);

proc_get_inode(dir->i_sb, de);

mod->exit()

proc_remove

remove_proc_subtree

proc_entry_rundown(de);

free_module(mod);

if (S_ISREG(inode->i_mode))

if (de->proc_ops->proc_read_iter)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References