Incorrect calculation in Linux kernel - CVE-2025-21687
Published: February 10, 2025 / Updated: May 11, 2025
Vulnerability identifier: #VU103753
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:U/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-21687
CWE-ID: CWE-682
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect calculation within the vfio_platform_read_mmio() and vfio_platform_write_mmio() functions in drivers/vfio/platform/vfio_platform_common.c. A local user can perform a denial of service (DoS) attack.
How to mitigate CVE-2025-21687
Install update from vendor's website.
Sources
- https://git.kernel.org/stable/c/665cfd1083866f87301bbd232cb8ba48dcf4acce
- https://git.kernel.org/stable/c/6bcb8a5b70b80143db9bf12dfa7d53636f824d53
- https://git.kernel.org/stable/c/92340e6c5122d823ad064984ef7513eba9204048
- https://git.kernel.org/stable/c/a20fcaa230f7472456d12cf761ed13938e320ac3
- https://git.kernel.org/stable/c/c981c32c38af80737a2fedc16e270546d139ccdd
- https://git.kernel.org/stable/c/ce9ff21ea89d191e477a02ad7eabf4f996b80a69
- https://git.kernel.org/stable/c/d19a8650fd3d7aed8d1af1d9a77f979a8430eba1
- https://git.kernel.org/stable/c/f21636f24b6786c8b13f1af4319fa75ffcf17f38
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.290