CVE-2025-21713: powerpc/pseries/iommu: Don't unset window if it was never set
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries/iommu: Don't unset window if it was never set
On pSeries, when user attempts to use the same vfio container used by different iommu group, the spaprtcesetwindow() returns -EPERM and the subsequent cleanup leads to the below crash.
Kernel attempted to read user page (308) - exploit attempt? BUG: Kernel NULL pointer dereference on read at 0x00000308 Faulting instruction address: 0xc0000000001ce358 Oops: Kernel access of bad area, sig: 11 [#1] NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0 <snip> NIP [c0000000001ce358] spaprtceunsetwindow+0x3b8/0x510 LR [c0000000001ce05c] spaprtceunsetwindow+0xbc/0x510 Call Trace: spaprtceunsetwindow+0xbc/0x510 (unreliable) tceiommuattachgroup+0x24c/0x340 [vfioiommuspaprtce] vfiocontainerattachgroup+0xec/0x240 [vfio] vfiogroupfopsunlioctl+0x548/0xb00 [vfio] sysioctl+0x754/0x1580 systemcallexception+0x13c/0x330 systemcallvectoredcommon+0x15c/0x2ec <snip> --- interrupt: 3000
Fix this by having null check for the tbl passed to the spaprtceunsetwindow().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel powerpc/pseries IOMMU code, update spapr_tce_unset_window() to null-check the tbl argument and avoid unsetting the window when it was never set.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21713?
The severity of CVE-2025-21713 is classified as moderate.
How do I fix CVE-2025-21713?
To fix CVE-2025-21713, update your Linux Kernel to a version that addresses the vulnerability.
What systems are affected by CVE-2025-21713?
CVE-2025-21713 affects Linux Kernel versions between 6.11 and 6.12.13, as well as versions between 6.13 and 6.13.2.
What impact does CVE-2025-21713 have on systems?
CVE-2025-21713 may prevent proper access to the vfio container when used with different iommu groups, resulting in a permission denied error.
Is CVE-2025-21713 a local or remote vulnerability?
CVE-2025-21713 is considered a local vulnerability, as it requires local access to exploit.