CVE-2025-21656

What it actually does

The drivetemp hwmon driver passes positive (SCSI) error codes from scsi_execute_cmd() directly to the hwmon core instead of converting them; hwmon only treats negative codes as errors, so uninitialized kernel memory is returned to userspace on SCSI failures such as drive disconnection.

Why it matters to the business

Drive-temperature monitoring can return garbage values, producing false hardware alerts or masking real disk problems on affected RHEL AUS 6.5 systems; prevalence across many kernel sub-packages increases the scope of required updates.

How an attack unfolds

An attacker triggers a SCSI error condition (for example by forcing a drive disconnect or sending malformed commands) while userspace reads the hwmon temperature attribute; the driver returns uninitialized data, disclosing kernel memory contents via the standard hwmon sysfs interface.

How to fix it

Update all listed Red Hat AUS 6.5 kernel packages to version 0:2.6.32-431.74.1.el6 or later; apply upstream commit 53e25b10a28edaf8c2a1d3916fd8929501a50dfc in custom kernels; reboot after package installation.

How to confirm the fix worked

Confirm installed kernel package versions match the fixed releases; reproduce a SCSI error and verify hwmon now returns -EIO instead of uninitialized data; inspect dmesg or hwmon logs for correct error handling.

Typical attack path

1. Induce SCSI error on target drive (disconnect, command failure)
2. Read drivetemp hwmon sysfs temperature file from userspace
3. Receive uninitialized kernel memory in the reported value

How to detect it

Search kernel logs for SCSI error entries around the same time as reads of drivetemp hwmon sysfs files; inspect userspace processes accessing /sys/class/hwmon/hwmon* when drive errors are present.

What your security team should do

• Prioritize patching all affected RHEL AUS 6.5 kernel packages to 2.6.32-431.74.1.el6
• Audit systems still running vulnerable kernels and schedule reboots
• Add monitoring for SCSI device errors correlated with hwmon reads