GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21738 (GCVE-0-2025-21738)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-08-05 11:54
VLAI
Title
ata: libata-sff: Ensure that we cannot write outside the allocated buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5a5dbd18a7496ed403f6f54bb20c955c65482fa5 , < a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c (git)
Affected: 5a5dbd18a7496ed403f6f54bb20c955c65482fa5 , < d5e6e3000309359eae2a17117aa6e3c44897bf6c (git)
Affected: 5a5dbd18a7496ed403f6f54bb20c955c65482fa5 , < 0dd5aade301a10f4b329fa7454fdcc2518741902 (git)
Affected: 5a5dbd18a7496ed403f6f54bb20c955c65482fa5 , < 0a17a9944b8d89ef03946121241870ac53ddaf45 (git)
Affected: 5a5dbd18a7496ed403f6f54bb20c955c65482fa5 , < 6e74e53b34b6dec5a50e1404e2680852ec6768d2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.22
Unaffected: 0 , < 2.6.22 (semver)
Unaffected: 6.1.129 , ≤ 6.1.* (semver)
Unaffected: 6.6.78 , ≤ 6.6.* (semver)
Unaffected: 6.12.14 , ≤ 6.12.* (semver)
Unaffected: 6.13.3 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:44.548Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/libata-sff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            },
            {
              "lessThan": "d5e6e3000309359eae2a17117aa6e3c44897bf6c",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            },
            {
              "lessThan": "0dd5aade301a10f4b329fa7454fdcc2518741902",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            },
            {
              "lessThan": "0a17a9944b8d89ef03946121241870ac53ddaf45",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            },
            {
              "lessThan": "6e74e53b34b6dec5a50e1404e2680852ec6768d2",
              "status": "affected",
              "version": "5a5dbd18a7496ed403f6f54bb20c955c65482fa5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/libata-sff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.22"
            },
            {
              "lessThan": "2.6.22",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-sff: Ensure that we cannot write outside the allocated buffer\n\nreveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len\nset to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to\nATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to\nwrite outside the allocated buffer, overwriting random memory.\n\nWhile a ATA device is supposed to abort a ATA_NOP command, there does seem\nto be a bug either in libata-sff or QEMU, where either this status is not\nset, or the status is cleared before read by ata_sff_hsm_move().\nAnyway, that is most likely a separate bug.\n\nLooking at __atapi_pio_bytes(), it already has a safety check to ensure\nthat __atapi_pio_bytes() cannot write outside the allocated buffer.\n\nAdd a similar check to ata_pio_sector(), such that also ata_pio_sector()\ncannot write outside the allocated buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered through the SCSI_IOCTL_SEND_COMMAND (or SG_IO) ioctl issued on a local ATA block device node, requiring local system access. There is no network-facing path into libata\u0027s PIO transfer code.\nAC:L - The attacker deterministically controls both required conditions \u2014 the buffer length (any out_len/in_len that is not a multiple of the 512-byte sector size) and the ATA sector count in the pass-through CDB \u2014 with no race, no memory-layout dependency, and no reliance on the device\u0027s error behaviour when a normal PIO read/write command is used.\nPR:L - The ATA_12 pass-through opcode 0xA1 aliases GPCMD_BLANK in scsi_cmd_allowed(), so it is permitted for any unprivileged user holding a write-opened fd on the block device \u2014 no CAP_SYS_RAWIO is needed \u2014 which is routinely the case for disk-group members, containers with device passthrough, and embedded/appliance images with permissive device nodes.\nUI:N - The attacker triggers the entire sequence from its own process via a single ioctl; no action by any other user or administrator is required.\nS:U - The out-of-bounds write corrupts kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - In the data-out direction (ATA_CMD_PIO_WRITE with an unaligned in_len) the kernel reads far past the end of the kmalloc\u0027d buffer and streams that kernel memory to attacker-chosen disk sectors, which can then simply be read back \u2014 an unbounded kernel-memory disclosure primitive.\nI:H - In the data-in direction the kernel writes up to ~128 KB of device-supplied data (contents of disk sectors the attacker previously wrote, hence fully controlled) past the end of a small slab allocation into adjacent pages, giving a controlled-content heap overflow suitable for control-flow hijacking and privilege escalation.\nA:H - Overwriting arbitrary adjacent kernel pages and slab metadata with attacker data reliably corrupts unrelated kernel structures, producing oopses, slab corruption BUGs, and full system panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:05.569Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5e6e3000309359eae2a17117aa6e3c44897bf6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dd5aade301a10f4b329fa7454fdcc2518741902"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a17a9944b8d89ef03946121241870ac53ddaf45"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e74e53b34b6dec5a50e1404e2680852ec6768d2"
        }
      ],
      "title": "ata: libata-sff: Ensure that we cannot write outside the allocated buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21738",
    "datePublished": "2025-02-27T02:12:13.942Z",
    "dateReserved": "2024-12-29T08:45:45.757Z",
    "dateUpdated": "2026-08-05T11:54:05.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21738",
      "date": "2026-09-16",
      "epss": "0.0022",
      "percentile": "0.12655"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:53:02.000Z",
      "cve": "CVE-2025-21738",
      "id": "msrc_CVE-2025-21738",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ata: libata-sff: Ensure that we cannot write outside the allocated buffer",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21738.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21738\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T03:15:14.427\",\"lastModified\":\"2026-07-30T06:21:21.990\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nata: libata-sff: Ensure that we cannot write outside the allocated buffer\\n\\nreveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len\\nset to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to\\nATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to\\nwrite outside the allocated buffer, overwriting random memory.\\n\\nWhile a ATA device is supposed to abort a ATA_NOP command, there does seem\\nto be a bug either in libata-sff or QEMU, where either this status is not\\nset, or the status is cleared before read by ata_sff_hsm_move().\\nAnyway, that is most likely a separate bug.\\n\\nLooking at __atapi_pio_bytes(), it already has a safety check to ensure\\nthat __atapi_pio_bytes() cannot write outside the allocated buffer.\\n\\nAdd a similar check to ata_pio_sector(), such that also ata_pio_sector()\\ncannot write outside the allocated buffer.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ata: libata-sff: Aseg\u00farese de que no podamos escribir fuera del b\u00fafer asignado reveliofuzzing inform\u00f3 que un ioctl SCSI_IOCTL_SEND_COMMAND con out_len establecido en 0xd42, comando SCSI establecido en ATA_16 PASS-THROUGH, comando ATA establecido en ATA_NOP y protocolo establecido en ATA_PROT_PIO, puede hacer que ata_pio_sector() escriba fuera del b\u00fafer asignado, sobrescribiendo memoria aleatoria. Si bien se supone que un dispositivo ATA debe abortar un comando ATA_NOP, parece haber un error en libata-sff o QEMU, donde este estado no est\u00e1 establecido o el estado se borra antes de la lectura por ata_sff_hsm_move(). De todos modos, es muy probable que se trate de un error separado. Si analizamos __atapi_pio_bytes(), veremos que ya tiene una comprobaci\u00f3n de seguridad para garantizar que __atapi_pio_bytes() no pueda escribir fuera del b\u00fafer asignado. Agreguemos una comprobaci\u00f3n similar a ata_pio_sector(), de modo que ata_pio_sector() tampoco pueda escribir fuera del b\u00fafer asignado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/ata/libata-sff.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5a5dbd18a7496ed403f6f54bb20c955c65482fa5\",\"lessThan\":\"a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a5dbd18a7496ed403f6f54bb20c955c65482fa5\",\"lessThan\":\"d5e6e3000309359eae2a17117aa6e3c44897bf6c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a5dbd18a7496ed403f6f54bb20c955c65482fa5\",\"lessThan\":\"0dd5aade301a10f4b329fa7454fdcc2518741902\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a5dbd18a7496ed403f6f54bb20c955c65482fa5\",\"lessThan\":\"0a17a9944b8d89ef03946121241870ac53ddaf45\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5a5dbd18a7496ed403f6f54bb20c955c65482fa5\",\"lessThan\":\"6e74e53b34b6dec5a50e1404e2680852ec6768d2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/ata/libata-sff.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.22\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.22\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.129\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.78\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.14\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.3\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.129\",\"matchCriteriaId\":\"18BF0B0B-D95C-472C-A99F-DE209F253F6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.78\",\"matchCriteriaId\":\"0C58261F-EDFB-4A12-8CCD-F12101482030\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.14\",\"matchCriteriaId\":\"033BB7EE-C9A2-45EA-BAC9-87BB9D951BCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.3\",\"matchCriteriaId\":\"0E92CEE3-1FC3-4AFC-A513-DEDBA7414F00\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a17a9944b8d89ef03946121241870ac53ddaf45\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0dd5aade301a10f4b329fa7454fdcc2518741902\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6e74e53b34b6dec5a50e1404e2680852ec6768d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d5e6e3000309359eae2a17117aa6e3c44897bf6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:39:19+00:00",
      "cve": "CVE-2025-21738",
      "id": "CVE-2025-21738",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21738.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-30T02:05:41Z",
      "cve": "CVE-2025-21738",
      "id": "CVE-2025-21738",
      "initial_release_date": "2025-02-28T02:21:39Z",
      "product_status:known_affected": "554",
      "product_status:known_not_affected": "38",
      "product_status:recommended": "734",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21738",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21738.json",
      "version": "60"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.