CVE-2025-21661

What it actually does

Missing cleanup of lookup tables on virtuser probe failure or platform_device_register_full failure, plus a memory leak in lookup_table->dev_id when toggling live state, allowing resource exhaustion and preventing subsequent successful probes.

Why it matters to the business

Kernel module instability can cause device configuration failures and memory leaks in environments using gpio virtuser via configfs, increasing operational overhead and potential downtime for affected systems until patched.

How an attack unfolds

An attacker with local access creates a virtuser device via configfs using an incorrect lookup table to trigger probe failure without cleanup, or repeatedly toggles live state to trigger the dev_id leak; no remote exploitation or named threat actors are associated.

How to fix it

Update the Linux kernel to commit d72d0126b1f6981f6ce8b4247305f359958c11b5 or later; apply the gpio_virtuser_remove_lookup_table function and ensure it is called on all error paths.

How to confirm the fix worked

Verify the presence of commit d72d0126b1f6981f6ce8b4247305f359958c11b5 in the kernel source; test configfs device creation with both correct and incorrect lookup tables to confirm cleanup occurs and no kmemleak reports appear.

Typical attack path

1. Obtain local access to a system with gpio virtuser enabled
2. Use configfs to create a virtuser device with malformed lookup table
3. Trigger repeated probe failures or live state toggles to exhaust resources or block future probes

How to detect it

Review kernel logs for repeated virtuser probe failures, configfs device creation events, and kmemleak warnings mentioning lookup_table or dev_id; no widespread exploitation indicators exist.

What your security team should do

• Prioritize kernel upgrade on all systems using gpio virtuser
• Monitor for memory leak reports via kmemleak in affected kernels
• Restrict configfs access to trusted users until patched