CVE-2025-21950: Debian Linux

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", which are then copied to user space. The initializer is indeed implemented in "acrn_hypercall2" (arch/x86/include/asm/acrn.h). There is a risk of information leakage due to uninitialized bytes.

Affected products

• Debian Debian Linux: version 11.0 only
• Linux Linux Kernel: from 5.12, before 5.15.179 (fixed in 5.15.179); from 5.16, before 6.1.131 (fixed in 6.1.131); from 6.2, before 6.6.83 (fixed in 6.6.83); from 6.7, before 6.12.19 (fixed in 6.12.19); from 6.13, before 6.13.7 (fixed in 6.13.7); version 6.14 only

Published 2025-04-01. Last modified 2026-06-17.