CyberSecBulletin
CVE-2025-21920NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2025-21920 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 7f1564b2b2072b7aa1ac75350e9560a07c7a44fd, fa40ebef69234e39ec2d26930d045f2fb9a8cb2b, 0fb7aa04c19eac4417f360a9f7611a60637bdacc as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 7f1564b2b2072b7aa1ac75350e9560a07c7a44fd or fa40ebef69234e39ec2d26930d045f2fb9a8cb2b or 0fb7aa04c19eac4417f360a9f7611a60637bdacc or 5a515d13e15536e82c5c7c83eb6cf5bc4827fee5, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.291 or 5.10.235 or 5.15.179 or 6.1.131, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux22bedad3ce112d5ca1eaf043d4990fa2ed698c87 up to, but not including, 7f1564b2b2072b7aa1ac75350e9560a07c7a44fd; 22bedad3ce112d5ca1eaf043d4990fa2ed698c87 up to, but not including, fa40ebef69234e39ec2d26930d045f2fb9a8cb2b; 22bedad3ce112d5ca1eaf043d4990fa2ed698c87 up to, but not including, 0fb7aa04c19eac4417f360a9f7611a60637bdacc; 22bedad3ce112d5ca1eaf043d4990fa2ed698c87 up to, but not including, 5a515d13e15536e82c5c7c83eb6cf5bc4827fee5; 22bedad3ce112d5ca1eaf043d4990fa2ed698c87 up to, but not including, 3561442599804905c3defca241787cd4546e99a7; 22bedad3ce112d5ca1eaf043d4990fa2ed698c87 up to, but not including, 30e8aee77899173a82ae5ed89f536c096f20aaeb; 22bedad3ce112d5ca1eaf043d4990fa2ed698c87 up to, but not including, b6c72479748b7ea09f53ed64b223cee6463dc278; 22bedad3ce112d5ca1eaf043d4990fa2ed698c87 up to, but not including, b33a534610067ade2bdaf2052900aaad99701353; and 1 more ranges7f1564b2b2072b7aa1ac75350e9560a07c7a44fd, fa40ebef69234e39ec2d26930d045f2fb9a8cb2b, 0fb7aa04c19eac4417f360a9f7611a60637bdacc, 5a515d13e15536e82c5c7c83eb6cf5bc4827fee5, 3561442599804905c3defca241787cd4546e99a7, 30e8aee77899173a82ae5ed89f536c096f20aaeb
LinuxLinux Kernel2.6.35 up to, but not including, 5.4.291; 5.5 up to, but not including, 5.10.235; 5.11 up to, but not including, 5.15.179; 5.16 up to, but not including, 6.1.131; 6.2 up to, but not including, 6.6.83; 6.7 up to, but not including, 6.12.19; 6.13 up to, but not including, 6.13.7; 6.145.4.291, 5.10.235, 5.15.179, 6.1.131, 6.6.83, 6.12.19

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.1HighNVD
CVSS 3.17.1HighCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leaks the address of a kernel function to usermode. When creating a VLAN device, we initialize GARP (garp_init_applicant) and MRP (mrp_init_applicant) for the underlying device. As part of the initialization process, we add the multicast address of each applicant to the underlying device, by calling dev_mc_add. __dev_mc_add uses dev->addr_len to determine the length of the new multicast address. This causes an out-of-bounds read if dev->addr_len is greater than 6, since the multicast addresses provided by GARP and MRP are only 6 bytes long. This behaviour can be reproduced using the following commands: ip tunnel add gretest mode ip6gre local ::1 remote ::2 dev lo ip l set up dev gretest ip link add link gretest name vlantest type vlan id 100 Then, the following command will display the address of garp_pdu_rcv: ip maddr show | grep 01:80:c2:00:00:21 Fix the bug by enforcing the type of the underlying device during VLAN device initialization.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.