CyberSecBulletin
CVE-2025-21719NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2025-21719 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 71a0fcb68c0a5f3ec912b540cd5d72148e6ee5f1, 53df27fd38f84bd3cd6b004eb4ff3c4903114f1d, 547ef7e8cbb98f966c8719a3e15d4e078aaa9b47 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 71a0fcb68c0a5f3ec912b540cd5d72148e6ee5f1 or 53df27fd38f84bd3cd6b004eb4ff3c4903114f1d or 547ef7e8cbb98f966c8719a3e15d4e078aaa9b47 or 57177c5f47a8da852f8d76cf6945cf803f8bb9e5, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.291 or 5.10.235 or 5.15.179 or 6.1.129, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxcb167893f41e21e6bd283d78e53489289dc0592d up to, but not including, 71a0fcb68c0a5f3ec912b540cd5d72148e6ee5f1; cb167893f41e21e6bd283d78e53489289dc0592d up to, but not including, 53df27fd38f84bd3cd6b004eb4ff3c4903114f1d; cb167893f41e21e6bd283d78e53489289dc0592d up to, but not including, 547ef7e8cbb98f966c8719a3e15d4e078aaa9b47; cb167893f41e21e6bd283d78e53489289dc0592d up to, but not including, 57177c5f47a8da852f8d76cf6945cf803f8bb9e5; cb167893f41e21e6bd283d78e53489289dc0592d up to, but not including, b379b3162ff55a70464c6a934ae9bf0497478a62; cb167893f41e21e6bd283d78e53489289dc0592d up to, but not including, a099834a51ccf9bbba3de86a251b3433539abfde; cb167893f41e21e6bd283d78e53489289dc0592d up to, but not including, 26bb7d991f04eeef47dfad23e533834995c26f7a; cb167893f41e21e6bd283d78e53489289dc0592d up to, but not including, 15a901361ec3fb1c393f91880e1cbf24ec0a88bd; and 1 more ranges71a0fcb68c0a5f3ec912b540cd5d72148e6ee5f1, 53df27fd38f84bd3cd6b004eb4ff3c4903114f1d, 547ef7e8cbb98f966c8719a3e15d4e078aaa9b47, 57177c5f47a8da852f8d76cf6945cf803f8bb9e5, b379b3162ff55a70464c6a934ae9bf0497478a62, a099834a51ccf9bbba3de86a251b3433539abfde
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel4.20 up to, but not including, 5.4.291; 5.5 up to, but not including, 5.10.235; 5.11 up to, but not including, 5.15.179; 5.16 up to, but not including, 6.1.129; 6.2 up to, but not including, 6.6.76; 6.7 up to, but not including, 6.12.13; 6.13 up to, but not including, 6.13.25.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.76, 6.12.13

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.1HighCNA
CVSS 3.17.1HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: ipmr: do not call mr_mfc_uses_dev() for unres entries syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif alias to "struct sk_buff_head unresolved", which contain two pointers. This code never worked, lets remove it. [1] Unable to handle kernel paging request at virtual address ffff5fff2d536613 KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] Modules linked in: CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline] lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 Call trace: mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P) mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P) mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382 ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648 rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327 rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791 netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317 netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973 sock_recvmsg_nosec net/socket.c:1033 [inline] sock_recvmsg net/socket.c:1055 [inline] sock_read_iter+0x2d8/0x40c net/socket.c:1125 new_sync_read fs/read_write.c:484 [inline] vfs_read+0x740/0x970 fs/read_write.c:565 ksys_read+0x15c/0x26c fs/read_write.c:708

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.