Information Leak Vulnerability in Linux Kernel: pmcmd_ioctl Function
Summary
CVE-2025-21950: In the Linux kernel, the following vulnerability has been resolved: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are ini... Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It is known for its stability, performance, and versatility, making it a popular choice for servers, desktops, and embedded systems. However, vulnerabilities can arise, such as the one identified in the pmcmd_ioctl function, which can lead to potential information leaks due to improper memory handling.
Vulnerability Detail
In the Linux kernel, specifically within the pmcmd_ioctl function, three memory objects allocated by kmalloc are initialized using hcall_get_cpu_state. These objects are then copied to user space, which poses a risk of information leakage due to the presence of uninitialized bytes. This vulnerability can allow an attacker to access sensitive information that should not be exposed, potentially compromising system security.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-21950 vulnerability in the Linux kernel's pmcmd_ioctl function poses a significant risk of information leakage. It is crucial for users to update their systems to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21950 is a vulnerability in the Linux kernel that can lead to information leakage due to uninitialized memory being copied to user space.
If exploited, this vulnerability could allow attackers to access sensitive information from uninitialized memory, potentially compromising system security.
Versions of the Linux kernel prior to 6.12.19-1 for Debian 13 are affected. Check your version and update accordingly.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit https://vulert.com to learn more.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
