{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21650", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.728Z", "datePublished": "2025-01-19T10:18:07.976Z", "dateUpdated": "2026-08-05T11:53:22.580Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:53:22.580Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue\n\nThe TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs\n1024-1279 are in different BAR space addresses. However,\nhclge_fetch_pf_reg does not distinguish the tqp space information when\nreading the tqp space information. When the number of TQPs is greater\nthan 1024, access bar space overwriting occurs.\nThe problem of different segments has been considered during the\ninitialization of tqp.io_base. Therefore, tqp.io_base is directly used\nwhen the queue is read in hclge_fetch_pf_reg.\n\nThe error message:\n\nUnable to handle kernel paging request at virtual address ffff800037200000\npc : hclge_fetch_pf_reg+0x138/0x250 [hclge]\nlr : hclge_get_regs+0x84/0x1d0 [hclge]\nCall trace:\n hclge_fetch_pf_reg+0x138/0x250 [hclge]\n hclge_get_regs+0x84/0x1d0 [hclge]\n hns3_get_regs+0x2c/0x50 [hns3]\n ethtool_get_regs+0xf4/0x270\n dev_ethtool+0x674/0x8a0\n dev_ioctl+0x270/0x36c\n sock_do_ioctl+0x110/0x2a0\n sock_ioctl+0x2ac/0x530\n __arm64_sys_ioctl+0xa8/0x100\n invoke_syscall+0x4c/0x124\n el0_svc_common.constprop.0+0x140/0x15c\n do_el0_svc+0x30/0xd0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xb0/0xb4\n el0_sync+0x168/0x180" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The only route to the vulnerable code is a local `ioctl(SIOCETHTOOL, ETHTOOL_GREGS)` on a socket, as shown by the commit's own call trace (`__arm64_sys_ioctl` → `sock_ioctl` → `dev_ethtool` → `hclge_fetch_pf_reg`). No remote or adjacent-network input reaches this path.\nAC:L - On an affected HNS3 PF (≥1024 TQPs assigned to the PF vport, which is the default when SR-IOV is not enabled), a single `ethtool -d ethX` deterministically walks past the end of the BAR2 mapping; there is no race, no memory-layout dependency, and no state the attacker cannot arrange.\nPR:L - `ETHTOOL_GREGS` is gated on `ns_capable(net->user_ns, CAP_NET_ADMIN)`, not on real root — a non-root telemetry/monitoring process holding only `cap_net_admin+ep`, or a container process with CAP_NET_ADMIN over a delegated network namespace holding the hns3 netdev, can reach it without any administrative account.\nUI:N - The attacker issues the ethtool ioctl directly; no victim action, mount, or file open is required.\nS:U - The out-of-bounds MMIO access and its consequences are entirely contained within the kernel of the same host, with no crossing of a VM, IOMMU, or sandbox authority boundary.\nC:H - The defect is an out-of-bounds read spanning up to ~128 KB beyond the ioremapped BAR2 window, and every value read is copied straight to userspace by `ethtool_get_regs()` — far beyond a \"few bounded bytes\", so on BAR layouts where the accesses do not immediately fault it discloses register/MMIO content the caller was never meant to see.\nI:N - The destination buffer is correctly sized by `hclge_get_regs_len()` using the same `kinfo->num_tqps`, so there is no out-of-bounds write; the erroneous accesses are read-only MMIO loads with no attacker-controlled modification of kernel state.\nA:H - The first out-of-bounds access lands on unmapped vmalloc space, producing the \"Unable to handle kernel paging request at virtual address ffff800037200000\" oops recorded in the fix commit — a kernel crash that any permitted caller can trigger repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c", "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c" ], "versions": [ { "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "lessThan": "0575baa733fc4219f230aef22d5bc35d922f1e9a", "status": "affected", "versionType": "git" }, { "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "lessThan": "7997ddd46c54408bcba5e37fe18b4d832e45d4d4", "status": "affected", "versionType": "git" }, { "version": "df34972a33d268a7113c119fe4e4b07a6819aa0c", "status": "affected", "versionType": "git" }, { "version": "2b1fff96a297034f03466cfecda9824adafe16ed", "status": "affected", "versionType": "git" }, { "version": "6.4.16", "lessThan": "6.5", "status": "affected", "versionType": "semver" }, { "version": "6.5.3", "lessThan": "6.6", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c", "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c" ], "versions": [ { "version": "6.6", "status": "affected" }, { "version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.10", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0575baa733fc4219f230aef22d5bc35d922f1e9a" }, { "url": "https://git.kernel.org/stable/c/7997ddd46c54408bcba5e37fe18b4d832e45d4d4" } ], "title": "net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-21650", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-10-01T19:53:49.493416Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:57:16.978Z" } } ] } }