CVE-2025-21952
📋 TL;DR
A race condition vulnerability in the Linux kernel's Corsair VOID HID driver could cause kernel panics when handling battery status updates. This affects systems using Corsair VOID wireless peripherals with vulnerable kernel versions. The vulnerability requires physical access to the affected device.
💻 Affected Systems
- Linux kernel with corsair-void HID driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, requiring physical reboot.
Likely Case
System instability or crash when interacting with Corsair VOID devices, particularly during battery status changes.
If Mitigated
Minor system disruption that self-resolves or requires device reconnection.
🎯 Exploit Status
Exploitation requires physical access to connect/disconnect Corsair VOID devices to trigger the race condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commits 0c28e4d1e10d2aae608094620bb386e6fd73d55e and de19c9dfb68f7c5791accc89047f92e952f57996
Vendor Advisory: https://git.kernel.org/stable/c/0c28e4d1e10d2aae608094620bb386e6fd73d55e
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version. 2. Rebuild kernel if using custom kernel. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable corsair-void driver
linuxPrevent loading of the vulnerable driver module
echo 'blacklist corsair_void' >> /etc/modprobe.d/blacklist.conf
rmmod corsair_void
Disconnect Corsair VOID devices
allRemove the vulnerable hardware from the system
🧯 If You Can't Patch
- Disconnect all Corsair VOID wireless peripherals from affected systems
- Implement physical security controls to prevent unauthorized device connections
🔍 How to Verify
Check if Vulnerable:
Check if corsair_void kernel module is loaded: lsmod | grep corsair_voidCheck Version:
uname -rVerify Fix Applied:
Check kernel version includes fix commits: uname -r and verify against patched versions📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/log/kern.log or dmesg
- OOM killer messages related to corsair_void
SIEM Query:
source="kernel" AND ("panic" OR "Oops") AND "corsair_void"