CVE-2025-21663Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux

Severity
5.5MEDIUMNVD
OSV7.8OSV7.1OSV6.2
EPSS
0.0%
top 94.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 21
Latest updateMay 29

Description

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree Nvidia's Tegra MGBE controllers require the IOMMU "Stream ID" (SID) to be written to the MGBE_WRAP_AXI_ASID0_CTRL register. The current driver is hard coded to use MGBE0's SID for all controllers. This causes softirq time outs and kernel panics when using controllers other than MGBE0. Example dmesg errors when an ethernet cable is connected to MGBE1: [ 116.1332

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

NVDlinux/linux_kernel6.26.6.72+2
Debianlinux/linux_kernel< 6.12.10-1+1
Ubuntulinux/linux_kernel< 6.8.0-60.63
CVEListV5linux/linuxd8ca113724e79b324f553914cefa9dd6961de152235419f0956e8c60e597aa1619ded8bda7460bb4+3
debiandebian/linux< linux 6.12.10-1 (forky)

Patches

🔴Vulnerability Details

18
OSV
linux-oracle-6.8 vulnerabilities2025-05-29
OSV
linux-hwe-6.8 vulnerabilities2025-05-28
OSV
linux-raspi vulnerabilities2025-05-26
OSV
linux-azure-nvidia vulnerabilities2025-05-20
OSV
linux-raspi-realtime vulnerabilities2025-05-20

📋Vendor Advisories

18
Ubuntu
Linux kernel (Oracle) vulnerabilities2025-05-29
Ubuntu
Linux kernel (HWE) vulnerabilities2025-05-28
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities2025-05-26
Ubuntu
Linux kernel vulnerabilities2025-05-20
Ubuntu
Linux kernel (Azure, N-Series) vulnerabilities2025-05-20
CVE-2025-21663 — Linux vulnerability | cvebase