Linux: Out-of-bounds Read
CVE-2025-22104 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 19efa170e01207c8ada726f3f6c65b31fcba2a73, 9bc078818ec76344c2e06b81d7aee2df3adecfbf, 005fee039dd845122d313ac8f2122b0d09dc5d7b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.23% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 19efa170e01207c8ada726f3f6c65b31fcba2a73 or 9bc078818ec76344c2e06b81d7aee2df3adecfbf or 005fee039dd845122d313ac8f2122b0d09dc5d7b or ae6b1d6c1acee3a2000394d83ec9f1028321e207, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.14.2 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 032c5e82847a2214c3196a90f0aeba0ce252de58 up to, but not including, 19efa170e01207c8ada726f3f6c65b31fcba2a73; 032c5e82847a2214c3196a90f0aeba0ce252de58 up to, but not including, 9bc078818ec76344c2e06b81d7aee2df3adecfbf; 032c5e82847a2214c3196a90f0aeba0ce252de58 up to, but not including, 005fee039dd845122d313ac8f2122b0d09dc5d7b; 032c5e82847a2214c3196a90f0aeba0ce252de58 up to, but not including, ae6b1d6c1acee3a2000394d83ec9f1028321e207; 032c5e82847a2214c3196a90f0aeba0ce252de58 up to, but not including, d93a6caab5d7d9b5ce034d75b1e1e993338e3852; 4.5 | 19efa170e01207c8ada726f3f6c65b31fcba2a73, 9bc078818ec76344c2e06b81d7aee2df3adecfbf, 005fee039dd845122d313ac8f2122b0d09dc5d7b, ae6b1d6c1acee3a2000394d83ec9f1028321e207, d93a6caab5d7d9b5ce034d75b1e1e993338e3852 |
| Linux | Linux Kernel | 4.5 up to, but not including, 6.14.2 | 6.14.2 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8 then a read buffer overflow was possible. Therefore, create a new ibmvnic function that loops over a buffer and calls hex_dump_to_buffer instead. This patch address KASAN reports like the one below: ibmvnic 30000003 env3: Login Buffer: ibmvnic 30000003 env3: 01000000af000000 <...> ibmvnic 30000003 env3: 2e6d62692e736261 ibmvnic 30000003 env3: 65050003006d6f63 ================================================================== BUG: KASAN: slab-out-of-bounds in ibmvnic_login+0xacc/0xffc [ibmvnic] Read of size 8 at addr c0000001331a9aa8 by task ip/17681 <...> Allocated by task 17681: <...> ibmvnic_login+0x2f0/0xffc [ibmvnic] ibmvnic_open+0x148/0x308 [ibmvnic] __dev_open+0x1ac/0x304 <...> The buggy address is located 168 bytes inside of allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf) <...> ================================================================= ibmvnic 30000003 env3: 000000000033766e
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other references
Recent Out-of-bounds Read vulnerabilities
- 8.8 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
Spotted an error? Tell us.