CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls
In the Linux kernel, the following vulnerability has been resolved:
vfio/platform: check the bounds of read/write syscalls
count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21687?
CVE-2025-21687 has a moderate severity due to risks associated with bounds checking in read/write syscalls.
How do I fix CVE-2025-21687?
To fix CVE-2025-21687, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What are the consequences of exploiting CVE-2025-21687?
Exploiting CVE-2025-21687 may allow an attacker to read or write outside the bounds of the device, potentially leading to data corruption or unauthorized access.
Which versions of the Linux kernel are affected by CVE-2025-21687?
CVE-2025-21687 affects specific versions of the Linux kernel where bounds checking on user-space inputs was not properly implemented.
Is CVE-2025-21687 related to any specific device drivers?
CVE-2025-21687 is related to vfio/platform device drivers that handle read/write syscalls without adequate input validation.