CVE-2025-21687

vfio/platform: check the bounds of read/write syscalls

State: Published
Severity: 7.8 High
Published: Feb 10, 2025
Updated: Aug 5, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

vfio/platform: check the bounds of read/write syscalls

count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6e3f264560099869f68830cb14b3b3e71e5ac76a to before f21636f24b6786c8b13f1af4319fa75ffcf17f38Affected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before 9377cdc118cf327248f1a9dde7b87de067681dc9Affected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before d19a8650fd3d7aed8d1af1d9a77f979a8430eba1Affected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before ed81d82bb6e9df3a137f2c343ed689e6c68268efAffected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before 92340e6c5122d823ad064984ef7513eba9204048Affected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before f65ce06387f8c1fb54bd59e18a8428248ec68eafAffected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before 6bcb8a5b70b80143db9bf12dfa7d53636f824d53Affected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before 1485932496a1b025235af8aa1e21988d6b7ccd54Affected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before c981c32c38af80737a2fedc16e270546d139ccddAffected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before a20fcaa230f7472456d12cf761ed13938e320ac3Affected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before 665cfd1083866f87301bbd232cb8ba48dcf4acceAffected 6e3f264560099869f68830cb14b3b3e71e5ac76a to before ce9ff21ea89d191e477a02ad7eabf4f996b80a69Affected
LinuxLinux	4.1Affected before 4.1Not affected 5.4.290 through 5.4.Not affected 5.4.291 through 5.4.Not affected 5.10.234 through 5.10.Not affected 5.10.235 through 5.10.Not affected 5.15.178 through 5.15.Not affected 5.15.179 through 5.15.Not affected 6.1.128 through 6.1.Not affected 6.1.129 through 6.1.Not affected 6.6.75 through 6.6.Not affected 6.12.12 through 6.12.Not affected 6.13.1 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

6e3f264560099869f68830cb14b3b3e71e5ac76a to before f21636f24b6786c8b13f1af4319fa75ffcf17f38Affected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before 9377cdc118cf327248f1a9dde7b87de067681dc9Affected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before d19a8650fd3d7aed8d1af1d9a77f979a8430eba1Affected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before ed81d82bb6e9df3a137f2c343ed689e6c68268efAffected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before 92340e6c5122d823ad064984ef7513eba9204048Affected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before f65ce06387f8c1fb54bd59e18a8428248ec68eafAffected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before 6bcb8a5b70b80143db9bf12dfa7d53636f824d53Affected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before 1485932496a1b025235af8aa1e21988d6b7ccd54Affected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before c981c32c38af80737a2fedc16e270546d139ccddAffected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before a20fcaa230f7472456d12cf761ed13938e320ac3Affected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before 665cfd1083866f87301bbd232cb8ba48dcf4acceAffected
6e3f264560099869f68830cb14b3b3e71e5ac76a to before ce9ff21ea89d191e477a02ad7eabf4f996b80a69Affected

LinuxLinux

4.1Affected
before 4.1Not affected
5.4.290 through 5.4.*Not affected
5.4.291 through 5.4.*Not affected
5.10.234 through 5.10.*Not affected
5.10.235 through 5.10.*Not affected
5.15.178 through 5.15.*Not affected
5.15.179 through 5.15.*Not affected
6.1.128 through 6.1.*Not affected
6.1.129 through 6.1.*Not affected
6.6.75 through 6.6.*Not affected
6.12.12 through 6.12.*Not affected
6.13.1 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.