CVE-2025-21713
published 2025-02-27CVE-2025-21713: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when user…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries/iommu: Don't unset window if it was never set
On pSeries, when user attempts to use the same vfio container used by
different iommu group, the spapr_tce_set_window() returns -EPERM
and the subsequent cleanup leads to the below crash.
Kernel attempted to read user page (308) - exploit attempt?
BUG: Kernel NULL pointer dereference on read at 0x00000308
Faulting instruction address: 0xc0000000001ce358
Oops: Kernel access of bad area, sig: 11 [#1]
NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0
NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510
LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510
Call Trace:
spapr_tce_unset_window+0xbc/0x510 (unreliable)
tce_iommu_attach_group+0x24c/0x340 [vfio_iommu_spapr_tce]
vfio_container_attach_group+0xec/0x240 [vfio]
vfio_group_fops_unl_ioctl+0x548/0xb00 [vfio]
sys_ioctl+0x754/0x1580
system_call_exception+0x13c/0x330
system_call_vectored_common+0x15c/0x2ec
--- interrupt: 3000
Fix this by having null check for the tbl passed to the
spapr_tce_unset_window().
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.13-1 (forky) | linux 6.12.13-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= f431a8cde7f102fce412546db6e62fdbde1131a7 < b853ff0b514c1df314246fcf94744005914b48cb | b853ff0b514c1df314246fcf94744005914b48cb |
| linux | linux | >= f431a8cde7f102fce412546db6e62fdbde1131a7 < ac12372a13dab3f7a2762db240bd180de8ef1e5e | ac12372a13dab3f7a2762db240bd180de8ef1e5e |
| linux | linux | >= f431a8cde7f102fce412546db6e62fdbde1131a7 < 17391cb2613b82f8c405570fea605af3255ff8d2 | 17391cb2613b82f8c405570fea605af3255ff8d2 |
| linux | linux_kernel | >= 0 < 6.12.13-1 | 6.12.13-1 |
| linux | linux_kernel | >= 0 < 6.12.13-1 | 6.12.13-1 |
| linux | linux_kernel | >= 6.11 < 6.12.13 | 6.12.13 |
| linux | linux_kernel | >= 6.13 < 6.13.2 | 6.13.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.12.12/6.13.1 spapr_tce_set_window null pointer dereference (Nessus ID 236983 / WID-SEC-2025-0453)
vuldb·2026-05-25·CVSS 5.5
CVE-2025-21713 [MEDIUM] Linux Kernel up to 6.12.12/6.13.1 spapr_tce_set_window null pointer dereference (Nessus ID 236983 / WID-SEC-2025-0453)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.12/6.13.1. The affected element is the function spapr_tce_set_window. The manipulation leads to null pointer dereference.
This vulnerability is traded as CVE-2025-21713. Access to the local network is required for this attack to succeed. There is no exploit available.
It is advisable to upgrade the affected component.
OSV
linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle vulnerabilities
osv·2025-05-28
linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle vulnerabilities
linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
- IOMMU subsystem;
- Multiple dev
OSV
linux-aws vulnerabilities
osv·2025-05-22
linux-aws vulnerabilities
linux-aws vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
- IOMMU subsystem;
- Multiple devices driver;
- Media drivers;
- NVIDIA Tegra mem
OSV
linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities
osv·2025-05-20
linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities
linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers
OSV
CVE-2025-21713: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when use
osv·2025-02-27·CVSS 5.5
CVE-2025-21713 [MEDIUM] CVE-2025-21713: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when use
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when user attempts to use the same vfio container used by different iommu group, the spapr_tce_set_window() returns -EPERM and the subsequent cleanup leads to the below crash. Kernel attempted to read user page (308) - exploit attempt? BUG: Kernel NULL pointer dereference on read at 0x00000308 Faulting instruction address: 0xc0000000001ce358 Oops: Kernel access of bad area, sig: 11 [#1] NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0 NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510 LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510 Call Trace: spapr_tce_unset_window+0xbc/0x510 (unreliable) tce_iommu_attach_group+0x24c/0
GHSA
GHSA-r24p-j496-7rxg: In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries/iommu: Don't unset window if it was never set
On pSeries, when u
ghsa_unreviewed·2025-02-27
CVE-2025-21713 [MEDIUM] CWE-476 GHSA-r24p-j496-7rxg: In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries/iommu: Don't unset window if it was never set
On pSeries, when u
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries/iommu: Don't unset window if it was never set
On pSeries, when user attempts to use the same vfio container used by
different iommu group, the spapr_tce_set_window() returns -EPERM
and the subsequent cleanup leads to the below crash.
Kernel attempted to read user page (308) - exploit attempt?
BUG: Kernel NULL pointer dereference on read at 0x00000308
Faulting instruction address: 0xc0000000001ce358
Oops: Kernel access of bad area, sig: 11 [#1]
NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0
NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510
LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510
Call Trace:
spapr_tce_unset_window+0xbc/0x510 (unreliable)
tce_iommu_attach_group+0x2
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-05-28
CVE-2024-57977 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
- IOM
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2025-05-22
CVE-2025-21716 Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-05-20
CVE-2025-21716 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
- IOM
Red Hat
kernel: powerpc/pseries/iommu: Don't unset window if it was never set
vendor_redhat·2025-02-27·CVSS 5.5
CVE-2025-21713 [MEDIUM] CWE-476 kernel: powerpc/pseries/iommu: Don't unset window if it was never set
kernel: powerpc/pseries/iommu: Don't unset window if it was never set
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries/iommu: Don't unset window if it was never set
On pSeries, when user attempts to use the same vfio container used by
different iommu group, the spapr_tce_set_window() returns -EPERM
and the subsequent cleanup leads to the below crash.
Kernel attempted to read user page (308) - exploit attempt?
BUG: Kernel NULL pointer dereference on read at 0x00000308
Faulting instruction address: 0xc0000000001ce358
Oops: Kernel access of bad area, sig: 11 [#1]
NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0
NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510
LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510
Call Trace:
spapr
Debian
CVE-2025-21713: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pse...
vendor_debian·2025·CVSS 5.5
CVE-2025-21713 [MEDIUM] CVE-2025-21713: linux - In the Linux kernel, the following vulnerability has been resolved: powerpc/pse...
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when user attempts to use the same vfio container used by different iommu group, the spapr_tce_set_window() returns -EPERM and the subsequent cleanup leads to the below crash. Kernel attempted to read user page (308) - exploit attempt? BUG: Kernel NULL pointer dereference on read at 0x00000308 Faulting instruction address: 0xc0000000001ce358 Oops: Kernel access of bad area, sig: 11 [#1] NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0 NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510 LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510 Call Trace: spapr_tce_unset_window+0xbc/0x510 (unreliable) tce_iommu_attach_group+0x24c/0
No detection rules found.
No public exploits indexed.
2025-02-27
Published