CVE-2025-22097

What it actually does

The vulnerability allows a use-after-free and double free of the default_config pointer in the vkms driver if initialization fails, potentially leading to memory corruption in the Linux kernel DRM subsystem.

Why it matters to the business

Linux systems using affected kernels may experience crashes, privilege escalation, or system compromise, disrupting operations especially in virtualized or graphics-enabled environments with broad ecosystem prevalence.

How an attack unfolds

An attacker triggers a vkms driver initialization failure in virtualized setups, then leverages the flawed error path in vkms_exit to access or free already-released memory for potential kernel-level code execution.

How to fix it

Update affected packages to fixed versions including rhc 1:0.2.5-1.el8_10 for Red Hat Enterprise Linux 8 or kernel commit 49a69f67f53518bdd9b7eeebf019a2da6cc0e954 in the Linux stable tree.

How to confirm the fix worked

Confirm package or kernel versions match the listed fixed releases; test driver initialization succeeds without accessing freed pointers in error paths.

Typical attack path

1. Trigger vkms driver initialization failure through environmental or configuration conditions
2. Invoke vkms_exit which accesses uninitialized or freed default_config pointer
3. Exploit resulting use-after-free or double-free for memory corruption and privilege escalation

How to detect it

Review kernel logs and dmesg for vkms init failure messages, use-after-free warnings, or double-free panics; inspect system boot sequences involving DRM drivers.

What your security team should do

• Apply the specified kernel and package updates across all affected Linux systems
• Monitor kernel logs for vkms-related initialization errors or memory corruption warnings
• Limit deployment of vkms driver in production where feasible until patched