CVE-2025-21856

CVE-2025-21856 is a use-after-free vulnerability (CWE-416) in the Linux kernel's s390/ism subsystem. The issue arises because the code directly frees a struct device after calling device_add() without setting a proper release function, violating kernel expectations in drivers/base/core.c. Without a release function, the device is considered broken, and lingering references—such as those from sysfs—can lead to use-after-free conditions as other kernel components may still hold pointers to the freed memory.

A local attacker with low privileges (AV:L/AC:L/PR:L) can exploit this vulnerability without user interaction (UI:N) in a single-instance context (S:U). Successful exploitation could result in high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), with a CVSS v3.1 base score of 7.8, potentially allowing arbitrary code execution or system crashes on affected s390 systems.

Mitigation involves applying upstream kernel patches, as detailed in the referenced stable commits: 0505ff2936f1 (primary fix adding the release function), along with related updates in 915e34d5ad35, 940d15254d22, and e26e8ac27351. Security practitioners should update to kernels incorporating these changes on s390 architectures to address the improper device lifecycle management.