CVE-2025-21998: Linux Kernel

Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access. Make sure that all resources have been set up before registering the efivars.

Affected products

• Linux Linux Kernel: from 6.11, before 6.12.21 (fixed in 6.12.21); from 6.13, before 6.13.9 (fixed in 6.13.9); version 6.14 only

Published 2025-04-03. Last modified 2026-06-17.