Reachable assertion in Linux kernel - CVE-2025-21902
Published: April 2, 2025 / Updated: May 11, 2025
Vulnerability details
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to reachable assertion within the yoga_c630_ucsi_async_control() function in drivers/usb/typec/ucsi/ucsi_yoga_c630.c, within the ucsi_stm32g0_irq_handler() function in drivers/usb/typec/ucsi/ucsi_stm32g0.c, within the pmic_glink_ucsi_connector_status() function in drivers/usb/typec/ucsi/ucsi_glink.c, within the ucsi_acpi_read_version(), ucsi_acpi_async_control() and ucsi_gram_sync_control() functions in drivers/usb/typec/ucsi/ucsi_acpi.c, within the ucsi_reset_ppm() and ucsi_create() functions in drivers/usb/typec/ucsi/ucsi.c. A local user can perform a denial of service (DoS) attack.
Affected software
Ubuntu
linux (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-azure (Ubuntu package)
linux-image-6.11.0-1021-oem (Ubuntu package)
linux-image-oem-24.04b (Ubuntu package)
How to mitigate CVE-2025-21902
linux (Ubuntu package) - addressed in versions 6.11.0-28.28, 6.11.0-28.28~24.04.1, 6.11.0-1011.11, 6.11.0-1014.14, 6.11.0-1015.16, 6.11.0-1016.16, 6.11.0-1016.16~24.04.1, 6.11.0-1017.18
linux-lowlatency (Ubuntu package) - addressed in versions 6.11.0-1015.16, 6.11.0-1015.16~24.04.2
linux-azure (Ubuntu package) - addressed in versions 6.11.0-1018.18, 6.11.0-1018.18~24.04.1
linux-image-6.11.0-1021-oem (Ubuntu package) - update to 6.11.0-1021.21
linux-image-oem-24.04b (Ubuntu package) - update to 6.11.0-1021.21
External References
- https://git.kernel.org/stable/c/012b98cdb54c7d47743ee7fc402fa23f2d90529a
- https://git.kernel.org/stable/c/1aec5c9066965ac0984e385bbc31455ae31cbffc
- https://git.kernel.org/stable/c/976e7e9bdc7719a023a4ecccd2e3daec9ab20a40
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.19
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.7
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14