Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0019 8.7 —
AFFECTED Product Versions Fixed Linux 91581c4b3f29e2e22aeb1a62e842d529ca638b2d – — Linux 6.11 – 6.12.10
TIMELINE Dec 29 Reserved by Linux Jan 21 Published (CNA: Linux) Jul 30 RESCORED — CVE-2025-21661 (Linux). CVSS 7.8 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix missing lookup table cleanups When a virtuser device is created via configfs and the probe fails due to an incorrect lookup table, the table is not removed. This prevents subsequent probe attempts from succeeding, even if the issue is corrected, unless the device is released. Additionally, cleanup is also needed in the less likely case of platform_device_register_full() failure. Besides, a consistent memory leak in lookup_table->dev_id was spotted using kmemleak by toggling the live state between 0 and 1 with a correct lookup table. Introduce gpio_virtuser_remove_lookup_table() as the counterpart to the existing gpio_virtuser_make_lookup_table() and call it from all necessary points to ensure proper cleanup.
| Date | Event | Detail |
|---|---|---|
| December 29, 2024 | Reserved | Reserved by Linux |
| January 21, 2025 | Published | Published (CNA: Linux) |
| July 30, 2026 | RESCORED | RESCORED — CVE-2025-21661 (Linux). CVSS 7.8 → 5.5 (NVD). |
Authoritative record: CVE-2025-21661 at cve.org
Vendors: linux
Weaknesses: CWE-401
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-21661 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.