CVE-2025-21713: powerpc/pseries/iommu: Don't unset window if it was never set
First published: Thu Feb 27 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when user attempts to use the same vfio container used by different iommu group, the spapr_tce_set_window() returns -EPERM and the subsequent cleanup leads to the below crash. Kernel attempted to read user page (308) - exploit attempt? BUG: Kernel NULL pointer dereference on read at 0x00000308 Faulting instruction address: 0xc0000000001ce358 Oops: Kernel access of bad area, sig: 11 [#1] NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0 <snip> NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510 LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510 Call Trace: spapr_tce_unset_window+0xbc/0x510 (unreliable) tce_iommu_attach_group+0x24c/0x340 [vfio_iommu_spapr_tce] vfio_container_attach_group+0xec/0x240 [vfio] vfio_group_fops_unl_ioctl+0x548/0xb00 [vfio] sys_ioctl+0x754/0x1580 system_call_exception+0x13c/0x330 system_call_vectored_common+0x15c/0x2ec <snip> --- interrupt: 3000 Fix this by having null check for the tbl passed to the spapr_tce_unset_window().
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | >=6.11<6.12.13 | |
| Linux Kernel | >=6.13<6.13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-21713?
The severity of CVE-2025-21713 is classified as moderate.
How do I fix CVE-2025-21713?
To fix CVE-2025-21713, update your Linux Kernel to a version that addresses the vulnerability.
What systems are affected by CVE-2025-21713?
CVE-2025-21713 affects Linux Kernel versions between 6.11 and 6.12.13, as well as versions between 6.13 and 6.13.2.
What impact does CVE-2025-21713 have on systems?
CVE-2025-21713 may prevent proper access to the vfio container when used with different iommu groups, resulting in a permission denied error.
Is CVE-2025-21713 a local or remote vulnerability?
CVE-2025-21713 is considered a local vulnerability, as it requires local access to exploit.
- collector/mitre-cve
- source/MITRE
- agent/type
- agent/title
- agent/author
- agent/source
- agent/description
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/linux
- canonical/linux kernel
- version/linux kernel/6.11
- version/linux kernel/6.13