CVE-2025-21650 (GCVE-0-2025-21650)

Vulnerability from cvelistv5 – Published: 2025-01-19 10:18 – Updated: 2026-08-05 11:53
VLAI
Title
net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
Summary
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs 1024-1279 are in different BAR space addresses. However, hclge_fetch_pf_reg does not distinguish the tqp space information when reading the tqp space information. When the number of TQPs is greater than 1024, access bar space overwriting occurs. The problem of different segments has been considered during the initialization of tqp.io_base. Therefore, tqp.io_base is directly used when the queue is read in hclge_fetch_pf_reg. The error message: Unable to handle kernel paging request at virtual address ffff800037200000 pc : hclge_fetch_pf_reg+0x138/0x250 [hclge] lr : hclge_get_regs+0x84/0x1d0 [hclge] Call trace: hclge_fetch_pf_reg+0x138/0x250 [hclge] hclge_get_regs+0x84/0x1d0 [hclge] hns3_get_regs+0x2c/0x50 [hns3] ethtool_get_regs+0xf4/0x270 dev_ethtool+0x674/0x8a0 dev_ioctl+0x270/0x36c sock_do_ioctl+0x110/0x2a0 sock_ioctl+0x2ac/0x530 __arm64_sys_ioctl+0xa8/0x100 invoke_syscall+0x4c/0x124 el0_svc_common.constprop.0+0x140/0x15c do_el0_svc+0x30/0xd0 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:53 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 939ccd107ffcade20c9c7055a2e7ae0fd724fb72 , < 0575baa733fc4219f230aef22d5bc35d922f1e9a (git)
Affected: 939ccd107ffcade20c9c7055a2e7ae0fd724fb72 , < 7997ddd46c54408bcba5e37fe18b4d832e45d4d4 (git)
Affected: df34972a33d268a7113c119fe4e4b07a6819aa0c (git)
Affected: 2b1fff96a297034f03466cfecda9824adafe16ed (git)
Affected: 6.4.16 , < 6.5 (semver)
Affected: 6.5.3 , < 6.6 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.12.10 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:53:49.493416Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:16.978Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c",
            "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0575baa733fc4219f230aef22d5bc35d922f1e9a",
              "status": "affected",
              "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72",
              "versionType": "git"
            },
            {
              "lessThan": "7997ddd46c54408bcba5e37fe18b4d832e45d4d4",
              "status": "affected",
              "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "df34972a33d268a7113c119fe4e4b07a6819aa0c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2b1fff96a297034f03466cfecda9824adafe16ed",
              "versionType": "git"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c",
            "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue\n\nThe TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs\n1024-1279 are in different BAR space addresses. However,\nhclge_fetch_pf_reg does not distinguish the tqp space information when\nreading the tqp space information. When the number of TQPs is greater\nthan 1024, access bar space overwriting occurs.\nThe problem of different segments has been considered during the\ninitialization of tqp.io_base. Therefore, tqp.io_base is directly used\nwhen the queue is read in hclge_fetch_pf_reg.\n\nThe error message:\n\nUnable to handle kernel paging request at virtual address ffff800037200000\npc : hclge_fetch_pf_reg+0x138/0x250 [hclge]\nlr : hclge_get_regs+0x84/0x1d0 [hclge]\nCall trace:\n hclge_fetch_pf_reg+0x138/0x250 [hclge]\n hclge_get_regs+0x84/0x1d0 [hclge]\n hns3_get_regs+0x2c/0x50 [hns3]\n ethtool_get_regs+0xf4/0x270\n dev_ethtool+0x674/0x8a0\n dev_ioctl+0x270/0x36c\n sock_do_ioctl+0x110/0x2a0\n sock_ioctl+0x2ac/0x530\n __arm64_sys_ioctl+0xa8/0x100\n invoke_syscall+0x4c/0x124\n el0_svc_common.constprop.0+0x140/0x15c\n do_el0_svc+0x30/0xd0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xb0/0xb4\n el0_sync+0x168/0x180"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only route to the vulnerable code is a local `ioctl(SIOCETHTOOL, ETHTOOL_GREGS)` on a socket, as shown by the commit\u0027s own call trace (`__arm64_sys_ioctl` \u2192 `sock_ioctl` \u2192 `dev_ethtool` \u2192 `hclge_fetch_pf_reg`). No remote or adjacent-network input reaches this path.\nAC:L - On an affected HNS3 PF (\u22651024 TQPs assigned to the PF vport, which is the default when SR-IOV is not enabled), a single `ethtool -d ethX` deterministically walks past the end of the BAR2 mapping; there is no race, no memory-layout dependency, and no state the attacker cannot arrange.\nPR:L - `ETHTOOL_GREGS` is gated on `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`, not on real root \u2014 a non-root telemetry/monitoring process holding only `cap_net_admin+ep`, or a container process with CAP_NET_ADMIN over a delegated network namespace holding the hns3 netdev, can reach it without any administrative account.\nUI:N - The attacker issues the ethtool ioctl directly; no victim action, mount, or file open is required.\nS:U - The out-of-bounds MMIO access and its consequences are entirely contained within the kernel of the same host, with no crossing of a VM, IOMMU, or sandbox authority boundary.\nC:H - The defect is an out-of-bounds read spanning up to ~128 KB beyond the ioremapped BAR2 window, and every value read is copied straight to userspace by `ethtool_get_regs()` \u2014 far beyond a \"few bounded bytes\", so on BAR layouts where the accesses do not immediately fault it discloses register/MMIO content the caller was never meant to see.\nI:N - The destination buffer is correctly sized by `hclge_get_regs_len()` using the same `kinfo-\u003enum_tqps`, so there is no out-of-bounds write; the erroneous accesses are read-only MMIO loads with no attacker-controlled modification of kernel state.\nA:H - The first out-of-bounds access lands on unmapped vmalloc space, producing the \"Unable to handle kernel paging request at virtual address ffff800037200000\" oops recorded in the fix commit \u2014 a kernel crash that any permitted caller can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:22.580Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0575baa733fc4219f230aef22d5bc35d922f1e9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7997ddd46c54408bcba5e37fe18b4d832e45d4d4"
        }
      ],
      "title": "net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21650",
    "datePublished": "2025-01-19T10:18:07.976Z",
    "dateReserved": "2024-12-29T08:45:45.728Z",
    "dateUpdated": "2026-08-05T11:53:22.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21650",
      "date": "2026-08-21",
      "epss": "0.00201",
      "percentile": "0.10274"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21650\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T11:15:10.630\",\"lastModified\":\"2026-07-30T06:17:25.260\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue\\n\\nThe TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs\\n1024-1279 are in different BAR space addresses. However,\\nhclge_fetch_pf_reg does not distinguish the tqp space information when\\nreading the tqp space information. When the number of TQPs is greater\\nthan 1024, access bar space overwriting occurs.\\nThe problem of different segments has been considered during the\\ninitialization of tqp.io_base. Therefore, tqp.io_base is directly used\\nwhen the queue is read in hclge_fetch_pf_reg.\\n\\nThe error message:\\n\\nUnable to handle kernel paging request at virtual address ffff800037200000\\npc : hclge_fetch_pf_reg+0x138/0x250 [hclge]\\nlr : hclge_get_regs+0x84/0x1d0 [hclge]\\nCall trace:\\n hclge_fetch_pf_reg+0x138/0x250 [hclge]\\n hclge_get_regs+0x84/0x1d0 [hclge]\\n hns3_get_regs+0x2c/0x50 [hns3]\\n ethtool_get_regs+0xf4/0x270\\n dev_ethtool+0x674/0x8a0\\n dev_ioctl+0x270/0x36c\\n sock_do_ioctl+0x110/0x2a0\\n sock_ioctl+0x2ac/0x530\\n __arm64_sys_ioctl+0xa8/0x100\\n invoke_syscall+0x4c/0x124\\n el0_svc_common.constprop.0+0x140/0x15c\\n do_el0_svc+0x30/0xd0\\n el0_svc+0x1c/0x2c\\n el0_sync_handler+0xb0/0xb4\\n el0_sync+0x168/0x180\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net:hns3: se ha corregido el problema de que hclge_fetch_pf_reg accede al espacio de la barra fuera de los l\u00edmites El espacio BAR de TQP se divide en dos segmentos. Los TQP 0-1023 y los TQP 1024-1279 est\u00e1n en diferentes direcciones de espacio BAR. Sin embargo, hclge_fetch_pf_reg no distingue la informaci\u00f3n del espacio tqp al leer la informaci\u00f3n del espacio tqp. Cuando el n\u00famero de TQP es mayor que 1024, se produce una sobrescritura del espacio de la barra de acceso. El problema de los diferentes segmentos se ha considerado durante la inicializaci\u00f3n de tqp.io_base. Por lo tanto, tqp.io_base se utiliza directamente cuando se lee la cola en hclge_fetch_pf_reg. Mensaje de error: No se puede gestionar la solicitud de paginaci\u00f3n del n\u00facleo en la direcci\u00f3n virtual ffff800037200000 pc : hclge_fetch_pf_reg+0x138/0x250 [hclge] lr : hclge_get_regs+0x84/0x1d0 [hclge] Call trace: hclge_fetch_pf_reg+0x138/0x250 [hclge] hclge_get_regs+0x84/0x1d0 [hclge] hns3_get_regs+0x2c/0x50 [hns3] ethtool_get_regs+0xf4/0x270 dev_ethtool+0x674/0x8a0 dev_ioctl+0x270/0x36c sock_do_ioctl+0x110/0x2a0 sock_ioctl+0x2ac/0x530 __arm64_sys_ioctl+0xa8/0x100 invoke_syscall+0x4c/0x124 el0_svc_common.constprop.0+0x140/0x15c do_el0_svc+0x30/0xd0 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180 \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c\",\"drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"939ccd107ffcade20c9c7055a2e7ae0fd724fb72\",\"lessThan\":\"0575baa733fc4219f230aef22d5bc35d922f1e9a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"939ccd107ffcade20c9c7055a2e7ae0fd724fb72\",\"lessThan\":\"7997ddd46c54408bcba5e37fe18b4d832e45d4d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"df34972a33d268a7113c119fe4e4b07a6819aa0c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b1fff96a297034f03466cfecda9824adafe16ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.4.16\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.5.3\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c\",\"drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.10\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:53:49.493416Z\",\"id\":\"CVE-2025-21650\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.16\",\"versionEndExcluding\":\"6.5\",\"matchCriteriaId\":\"A5099559-2D15-42A5-A561-71B34FEFF36F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.3\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"027A0A90-C67C-4EB4-8FF4-E9701C342DF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0575baa733fc4219f230aef22d5bc35d922f1e9a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7997ddd46c54408bcba5e37fe18b4d832e45d4d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:41:01+00:00",
      "cve": "CVE-2025-21650",
      "id": "CVE-2025-21650",
      "initial_release_date": "2025-01-19T00:00:00+00:00",
      "product_status:known_affected": "104",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21650.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-16T18:52:43Z",
      "cve": "CVE-2025-21650",
      "id": "CVE-2025-21650",
      "initial_release_date": "2025-01-20T03:47:29Z",
      "product_status:known_affected": "410",
      "product_status:known_not_affected": "306",
      "product_status:recommended": "363",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21650",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21650.json",
      "version": "59"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21650\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:53:49.493416Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:55:56.524Z\"}}], \"cna\": {\"title\": \"net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The only route to the vulnerable code is a local `ioctl(SIOCETHTOOL, ETHTOOL_GREGS)` on a socket, as shown by the commit\u0027s own call trace (`__arm64_sys_ioctl` \\u2192 `sock_ioctl` \\u2192 `dev_ethtool` \\u2192 `hclge_fetch_pf_reg`). No remote or adjacent-network input reaches this path.\\nAC:L - On an affected HNS3 PF (\\u22651024 TQPs assigned to the PF vport, which is the default when SR-IOV is not enabled), a single `ethtool -d ethX` deterministically walks past the end of the BAR2 mapping; there is no race, no memory-layout dependency, and no state the attacker cannot arrange.\\nPR:L - `ETHTOOL_GREGS` is gated on `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`, not on real root \\u2014 a non-root telemetry/monitoring process holding only `cap_net_admin+ep`, or a container process with CAP_NET_ADMIN over a delegated network namespace holding the hns3 netdev, can reach it without any administrative account.\\nUI:N - The attacker issues the ethtool ioctl directly; no victim action, mount, or file open is required.\\nS:U - The out-of-bounds MMIO access and its consequences are entirely contained within the kernel of the same host, with no crossing of a VM, IOMMU, or sandbox authority boundary.\\nC:H - The defect is an out-of-bounds read spanning up to ~128 KB beyond the ioremapped BAR2 window, and every value read is copied straight to userspace by `ethtool_get_regs()` \\u2014 far beyond a \\\"few bounded bytes\\\", so on BAR layouts where the accesses do not immediately fault it discloses register/MMIO content the caller was never meant to see.\\nI:N - The destination buffer is correctly sized by `hclge_get_regs_len()` using the same `kinfo-\u003enum_tqps`, so there is no out-of-bounds write; the erroneous accesses are read-only MMIO loads with no attacker-controlled modification of kernel state.\\nA:H - The first out-of-bounds access lands on unmapped vmalloc space, producing the \\\"Unable to handle kernel paging request at virtual address ffff800037200000\\\" oops recorded in the fix commit \\u2014 a kernel crash that any permitted caller can trigger repeatedly.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"939ccd107ffcade20c9c7055a2e7ae0fd724fb72\", \"lessThan\": \"0575baa733fc4219f230aef22d5bc35d922f1e9a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"939ccd107ffcade20c9c7055a2e7ae0fd724fb72\", \"lessThan\": \"7997ddd46c54408bcba5e37fe18b4d832e45d4d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"df34972a33d268a7113c119fe4e4b07a6819aa0c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2b1fff96a297034f03466cfecda9824adafe16ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.4.16\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.5.3\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c\", \"drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c\", \"drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0575baa733fc4219f230aef22d5bc35d922f1e9a\"}, {\"url\": \"https://git.kernel.org/stable/c/7997ddd46c54408bcba5e37fe18b4d832e45d4d4\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue\\n\\nThe TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs\\n1024-1279 are in different BAR space addresses. However,\\nhclge_fetch_pf_reg does not distinguish the tqp space information when\\nreading the tqp space information. When the number of TQPs is greater\\nthan 1024, access bar space overwriting occurs.\\nThe problem of different segments has been considered during the\\ninitialization of tqp.io_base. Therefore, tqp.io_base is directly used\\nwhen the queue is read in hclge_fetch_pf_reg.\\n\\nThe error message:\\n\\nUnable to handle kernel paging request at virtual address ffff800037200000\\npc : hclge_fetch_pf_reg+0x138/0x250 [hclge]\\nlr : hclge_get_regs+0x84/0x1d0 [hclge]\\nCall trace:\\n hclge_fetch_pf_reg+0x138/0x250 [hclge]\\n hclge_get_regs+0x84/0x1d0 [hclge]\\n hns3_get_regs+0x2c/0x50 [hns3]\\n ethtool_get_regs+0xf4/0x270\\n dev_ethtool+0x674/0x8a0\\n dev_ioctl+0x270/0x36c\\n sock_do_ioctl+0x110/0x2a0\\n sock_ioctl+0x2ac/0x530\\n __arm64_sys_ioctl+0xa8/0x100\\n invoke_syscall+0x4c/0x124\\n el0_svc_common.constprop.0+0x140/0x15c\\n do_el0_svc+0x30/0xd0\\n el0_svc+0x1c/0x2c\\n el0_sync_handler+0xb0/0xb4\\n el0_sync+0x168/0x180\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.10\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.5.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:53:22.580Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21650\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:53:22.580Z\", \"dateReserved\": \"2024-12-29T08:45:45.728Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-19T10:18:07.976Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.