CVE-2025-21991 (GCVE-0-2025-21991)

Vulnerability from cvelistv5 – Published: 2025-04-02 12:53 – Updated: 2026-05-23 15:57
VLAI
Title
x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses per-CPU data for the first CPU of each mask. According to Documentation/admin-guide/mm/numaperf.rst: "Some memory may share the same node as a CPU, and others are provided as memory only nodes." Therefore, some node CPU masks may be empty and wouldn't have a "first CPU". On a machine with far memory (and therefore CPU-less NUMA nodes): - cpumask_of_node(nid) is 0 - cpumask_first(0) is CONFIG_NR_CPUS - cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an index that is 1 out of bounds This does not have any security implications since flashing microcode is a privileged operation but I believe this has reliability implications by potentially corrupting memory while flashing a microcode update. When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes a microcode update. I get the following splat: UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y index 512 is out of range for type 'unsigned long[512]' [...] Call Trace: dump_stack __ubsan_handle_out_of_bounds load_microcode_amd request_microcode_amd reload_store kernfs_fop_write_iter vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Change the loop to go over only NUMA nodes which have CPUs before determining whether the first CPU on the respective node needs microcode update. [ bp: Massage commit message, fix typo. ]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-129 - Improper Validation of Array Index
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 979e197968a1e8f09bf0d706801dba4432f85ab3 , < d509c4731090ebd9bbdb72c70a2d70003ae81f4f (git)
Affected: 44a44b57e88f311c1415be1f567c50050913c149 , < 985a536e04bbfffb1770df43c6470f635a6b1073 (git)
Affected: be2710deaed3ab1402379a2ede30a3754fe6767a , < 18b5d857c6496b78ead2fd10001b81ae32d30cac (git)
Affected: d576547f489c935b9897d4acf8beee3325dea8a5 , < ec52240622c4d218d0240079b7c1d3ec2328a9f4 (git)
Affected: 7ff6edf4fef38ab404ee7861f257e28eaaeed35f , < e686349cc19e800dac8971929089ba5ff59abfb0 (git)
Affected: 7ff6edf4fef38ab404ee7861f257e28eaaeed35f , < 488ffc0cac38f203979f83634236ee53251ce593 (git)
Affected: 7ff6edf4fef38ab404ee7861f257e28eaaeed35f , < 5ac295dfccb5b015493f86694fa13a0dde4d3665 (git)
Affected: 7ff6edf4fef38ab404ee7861f257e28eaaeed35f , < e3e89178a9f4a80092578af3ff3c8478f9187d59 (git)
Affected: d6353e2fc12c5b8f00f86efa30ed73d2da2f77be (git)
Affected: 1b1e0eb1d2971a686b9f7bdc146115bcefcbb960 (git)
Affected: eaf5dea1eb8c2928554b3ca717575cbe232b843c (git)
Affected: 5.4.235 , < 5.4.292 (semver)
Affected: 5.10.173 , < 5.10.236 (semver)
Affected: 5.15.99 , < 5.15.180 (semver)
Affected: 6.1.16 , < 6.1.132 (semver)
Affected: 4.14.308 , < 4.15 (semver)
Affected: 4.19.276 , < 4.20 (semver)
Affected: 6.2.3 , < 6.3 (semver)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 5.4.292 , ≤ 5.4.* (semver)
Unaffected: 5.10.236 , ≤ 5.10.* (semver)
Unaffected: 5.15.180 , ≤ 5.15.* (semver)
Unaffected: 6.1.132 , ≤ 6.1.* (semver)
Unaffected: 6.6.84 , ≤ 6.6.* (semver)
Unaffected: 6.12.20 , ≤ 6.12.* (semver)
Unaffected: 6.13.8 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:13:39.419226Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-129",
                "description": "CWE-129 Improper Validation of Array Index",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:13:42.269Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:40:28.243Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/microcode/amd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d509c4731090ebd9bbdb72c70a2d70003ae81f4f",
              "status": "affected",
              "version": "979e197968a1e8f09bf0d706801dba4432f85ab3",
              "versionType": "git"
            },
            {
              "lessThan": "985a536e04bbfffb1770df43c6470f635a6b1073",
              "status": "affected",
              "version": "44a44b57e88f311c1415be1f567c50050913c149",
              "versionType": "git"
            },
            {
              "lessThan": "18b5d857c6496b78ead2fd10001b81ae32d30cac",
              "status": "affected",
              "version": "be2710deaed3ab1402379a2ede30a3754fe6767a",
              "versionType": "git"
            },
            {
              "lessThan": "ec52240622c4d218d0240079b7c1d3ec2328a9f4",
              "status": "affected",
              "version": "d576547f489c935b9897d4acf8beee3325dea8a5",
              "versionType": "git"
            },
            {
              "lessThan": "e686349cc19e800dac8971929089ba5ff59abfb0",
              "status": "affected",
              "version": "7ff6edf4fef38ab404ee7861f257e28eaaeed35f",
              "versionType": "git"
            },
            {
              "lessThan": "488ffc0cac38f203979f83634236ee53251ce593",
              "status": "affected",
              "version": "7ff6edf4fef38ab404ee7861f257e28eaaeed35f",
              "versionType": "git"
            },
            {
              "lessThan": "5ac295dfccb5b015493f86694fa13a0dde4d3665",
              "status": "affected",
              "version": "7ff6edf4fef38ab404ee7861f257e28eaaeed35f",
              "versionType": "git"
            },
            {
              "lessThan": "e3e89178a9f4a80092578af3ff3c8478f9187d59",
              "status": "affected",
              "version": "7ff6edf4fef38ab404ee7861f257e28eaaeed35f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d6353e2fc12c5b8f00f86efa30ed73d2da2f77be",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1b1e0eb1d2971a686b9f7bdc146115bcefcbb960",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eaf5dea1eb8c2928554b3ca717575cbe232b843c",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.292",
              "status": "affected",
              "version": "5.4.235",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.236",
              "status": "affected",
              "version": "5.10.173",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.180",
              "status": "affected",
              "version": "5.15.99",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.132",
              "status": "affected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.308",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.276",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/microcode/amd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "5.4.235",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "5.10.173",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.15.99",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "6.1.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.84",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.308",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.276",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes\n\nCurrently, load_microcode_amd() iterates over all NUMA nodes, retrieves their\nCPU masks and unconditionally accesses per-CPU data for the first CPU of each\nmask.\n\nAccording to Documentation/admin-guide/mm/numaperf.rst:\n\n  \"Some memory may share the same node as a CPU, and others are provided as\n  memory only nodes.\"\n\nTherefore, some node CPU masks may be empty and wouldn\u0027t have a \"first CPU\".\n\nOn a machine with far memory (and therefore CPU-less NUMA nodes):\n- cpumask_of_node(nid) is 0\n- cpumask_first(0) is CONFIG_NR_CPUS\n- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an\n  index that is 1 out of bounds\n\nThis does not have any security implications since flashing microcode is\na privileged operation but I believe this has reliability implications by\npotentially corrupting memory while flashing a microcode update.\n\nWhen booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes\na microcode update. I get the following splat:\n\n  UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y\n  index 512 is out of range for type \u0027unsigned long[512]\u0027\n  [...]\n  Call Trace:\n   dump_stack\n   __ubsan_handle_out_of_bounds\n   load_microcode_amd\n   request_microcode_amd\n   reload_store\n   kernfs_fop_write_iter\n   vfs_write\n   ksys_write\n   do_syscall_64\n   entry_SYSCALL_64_after_hwframe\n\nChange the loop to go over only NUMA nodes which have CPUs before determining\nwhether the first CPU on the respective node needs microcode update.\n\n  [ bp: Massage commit message, fix typo. ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:57:34.986Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d509c4731090ebd9bbdb72c70a2d70003ae81f4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/985a536e04bbfffb1770df43c6470f635a6b1073"
        },
        {
          "url": "https://git.kernel.org/stable/c/18b5d857c6496b78ead2fd10001b81ae32d30cac"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec52240622c4d218d0240079b7c1d3ec2328a9f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e686349cc19e800dac8971929089ba5ff59abfb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/488ffc0cac38f203979f83634236ee53251ce593"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ac295dfccb5b015493f86694fa13a0dde4d3665"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3e89178a9f4a80092578af3ff3c8478f9187d59"
        }
      ],
      "title": "x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21991",
    "datePublished": "2025-04-02T12:53:14.230Z",
    "dateReserved": "2024-12-29T08:45:45.800Z",
    "dateUpdated": "2026-05-23T15:57:34.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21991",
      "date": "2026-06-26",
      "epss": "0.00181",
      "percentile": "0.07914"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21991\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-02T13:15:43.670\",\"lastModified\":\"2025-11-03T20:17:34.873\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes\\n\\nCurrently, load_microcode_amd() iterates over all NUMA nodes, retrieves their\\nCPU masks and unconditionally accesses per-CPU data for the first CPU of each\\nmask.\\n\\nAccording to Documentation/admin-guide/mm/numaperf.rst:\\n\\n  \\\"Some memory may share the same node as a CPU, and others are provided as\\n  memory only nodes.\\\"\\n\\nTherefore, some node CPU masks may be empty and wouldn\u0027t have a \\\"first CPU\\\".\\n\\nOn a machine with far memory (and therefore CPU-less NUMA nodes):\\n- cpumask_of_node(nid) is 0\\n- cpumask_first(0) is CONFIG_NR_CPUS\\n- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an\\n  index that is 1 out of bounds\\n\\nThis does not have any security implications since flashing microcode is\\na privileged operation but I believe this has reliability implications by\\npotentially corrupting memory while flashing a microcode update.\\n\\nWhen booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes\\na microcode update. I get the following splat:\\n\\n  UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y\\n  index 512 is out of range for type \u0027unsigned long[512]\u0027\\n  [...]\\n  Call Trace:\\n   dump_stack\\n   __ubsan_handle_out_of_bounds\\n   load_microcode_amd\\n   request_microcode_amd\\n   reload_store\\n   kernfs_fop_write_iter\\n   vfs_write\\n   ksys_write\\n   do_syscall_64\\n   entry_SYSCALL_64_after_hwframe\\n\\nChange the loop to go over only NUMA nodes which have CPUs before determining\\nwhether the first CPU on the respective node needs microcode update.\\n\\n  [ bp: Massage commit message, fix typo. ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/microcode/AMD: Se corrigi\u00f3 un error fuera de los l\u00edmites en sistemas con nodos NUMA sin CPU. Actualmente, load_microcode_amd() itera sobre todos los nodos NUMA, recupera sus m\u00e1scaras de CPU y accede incondicionalmente a los datos por CPU para la primera CPU de cada m\u00e1scara. Seg\u00fan Documentation/admin-guide/mm/numaperf.rst: \\\"Algunas memorias pueden compartir el mismo nodo que una CPU, mientras que otras se proporcionan como nodos de solo memoria\\\". Por lo tanto, algunas m\u00e1scaras de CPU de nodo podr\u00edan estar vac\u00edas y no tendr\u00edan una \\\"primera CPU\\\". En una m\u00e1quina con memoria extensa (y, por lo tanto, nodos NUMA sin CPU): - cpumask_of_node(nid) es 0 - cpumask_first(0) es CONFIG_NR_CPUS - cpu_data(CONFIG_NR_CPUS) accede a la matriz por CPU cpu_info en un \u00edndice que es 1 fuera de los l\u00edmites. Esto no tiene implicaciones de seguridad, ya que la actualizaci\u00f3n de microc\u00f3digo es una operaci\u00f3n privilegiada, pero creo que tiene implicaciones de confiabilidad al potencialmente corromper la memoria durante la actualizaci\u00f3n de microc\u00f3digo. Al arrancar con CONFIG_UBSAN_BOUNDS=y en una m\u00e1quina AMD que actualiza microc\u00f3digo. Recibo el siguiente mensaje: UBSAN: array-index-out-of-bounds en arch/x86/kernel/cpu/microcode/amd.c:X:Y el \u00edndice 512 est\u00e1 fuera de rango para el tipo \u0027unsigned long[512]\u0027 [...] Seguimiento de llamadas: dump_stack __ubsan_handle_out_of_bounds load_microcode_amd request_microcode_amd reload_store kernfs_fop_write_iter vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Cambie el bucle para que solo recorra los nodos NUMA que tengan CPU antes de determinar si la primera CPU en el nodo respectivo necesita una actualizaci\u00f3n de microc\u00f3digo. [bp: Mensaje de confirmaci\u00f3n de Massage, correcci\u00f3n de error tipogr\u00e1fico.]\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.308\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"83683E88-BE16-4997-9FDC-102DF930322C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.276\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"5495F696-4F37-41A0-9020-F01C49FD103A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.235\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"5B84C064-16CC-43FA-AE76-F62E41B8DCFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.173\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"DF6A0A9F-CF01-4C06-A4AC-AC7810053C8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.99\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"55A594E3-39FC-4F69-9614-C6FC3967986F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.16\",\"versionEndExcluding\":\"6.1.132\",\"matchCriteriaId\":\"3A183DD1-F3ED-43BE-99D2-3EA122C43457\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2.3\",\"versionEndExcluding\":\"6.6.84\",\"matchCriteriaId\":\"3405E1B5-835A-4D00-A7C5-AEA51D851B70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.20\",\"matchCriteriaId\":\"60E9C5DF-D778-4572-848A-5D6CFFE022CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.8\",\"matchCriteriaId\":\"0A20D4D7-B329-4C68-B662-76062EA7DCF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1759FFB7-531C-41B1-9AE1-FD3D80E0D920\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/18b5d857c6496b78ead2fd10001b81ae32d30cac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/488ffc0cac38f203979f83634236ee53251ce593\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ac295dfccb5b015493f86694fa13a0dde4d3665\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/985a536e04bbfffb1770df43c6470f635a6b1073\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d509c4731090ebd9bbdb72c70a2d70003ae81f4f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3e89178a9f4a80092578af3ff3c8478f9187d59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e686349cc19e800dac8971929089ba5ff59abfb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec52240622c4d218d0240079b7c1d3ec2328a9f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T13:06:52.038Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes\\n\\nCurrently, load_microcode_amd() iterates over all NUMA nodes, retrieves their\\nCPU masks and unconditionally accesses per-CPU data for the first CPU of each\\nmask.\\n\\nAccording to Documentation/admin-guide/mm/numaperf.rst:\\n\\n  \\\"Some memory may share the same node as a CPU, and others are provided as\\n  memory only nodes.\\\"\\n\\nTherefore, some node CPU masks may be empty and wouldn\u0027t have a \\\"first CPU\\\".\\n\\nOn a machine with far memory (and therefore CPU-less NUMA nodes):\\n- cpumask_of_node(nid) is 0\\n- cpumask_first(0) is CONFIG_NR_CPUS\\n- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an\\n  index that is 1 out of bounds\\n\\nThis does not have any security implications since flashing microcode is\\na privileged operation but I believe this has reliability implications by\\npotentially corrupting memory while flashing a microcode update.\\n\\nWhen booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes\\na microcode update. I get the following splat:\\n\\n  UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y\\n  index 512 is out of range for type \u0027unsigned long[512]\u0027\\n  [...]\\n  Call Trace:\\n   dump_stack\\n   __ubsan_handle_out_of_bounds\\n   load_microcode_amd\\n   request_microcode_amd\\n   reload_store\\n   kernfs_fop_write_iter\\n   vfs_write\\n   ksys_write\\n   do_syscall_64\\n   entry_SYSCALL_64_after_hwframe\\n\\nChange the loop to go over only NUMA nodes which have CPUs before determining\\nwhether the first CPU on the respective node needs microcode update.\\n\\n  [ bp: Massage commit message, fix typo. ]\"}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"arch/x86/kernel/cpu/microcode/amd.c\"], \"versions\": [{\"version\": \"979e197968a1e8f09bf0d706801dba4432f85ab3\", \"lessThan\": \"d509c4731090ebd9bbdb72c70a2d70003ae81f4f\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"44a44b57e88f311c1415be1f567c50050913c149\", \"lessThan\": \"985a536e04bbfffb1770df43c6470f635a6b1073\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"be2710deaed3ab1402379a2ede30a3754fe6767a\", \"lessThan\": \"18b5d857c6496b78ead2fd10001b81ae32d30cac\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"d576547f489c935b9897d4acf8beee3325dea8a5\", \"lessThan\": \"ec52240622c4d218d0240079b7c1d3ec2328a9f4\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"7ff6edf4fef38ab404ee7861f257e28eaaeed35f\", \"lessThan\": \"e686349cc19e800dac8971929089ba5ff59abfb0\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"7ff6edf4fef38ab404ee7861f257e28eaaeed35f\", \"lessThan\": \"488ffc0cac38f203979f83634236ee53251ce593\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"7ff6edf4fef38ab404ee7861f257e28eaaeed35f\", \"lessThan\": \"5ac295dfccb5b015493f86694fa13a0dde4d3665\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"7ff6edf4fef38ab404ee7861f257e28eaaeed35f\", \"lessThan\": \"e3e89178a9f4a80092578af3ff3c8478f9187d59\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"d6353e2fc12c5b8f00f86efa30ed73d2da2f77be\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"1b1e0eb1d2971a686b9f7bdc146115bcefcbb960\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"eaf5dea1eb8c2928554b3ca717575cbe232b843c\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"arch/x86/kernel/cpu/microcode/amd.c\"], \"versions\": [{\"version\": \"6.3\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"6.3\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.4.292\", \"lessThanOrEqual\": \"5.4.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.10.236\", \"lessThanOrEqual\": \"5.10.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"5.15.180\", \"lessThanOrEqual\": \"5.15.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.1.132\", \"lessThanOrEqual\": \"6.1.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.6.84\", \"lessThanOrEqual\": \"6.6.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.12.20\", \"lessThanOrEqual\": \"6.12.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.13.8\", \"lessThanOrEqual\": \"6.13.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.14\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.4.235\", \"versionEndExcluding\": \"5.4.292\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10.173\", \"versionEndExcluding\": \"5.10.236\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15.99\", \"versionEndExcluding\": \"5.15.180\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1.16\", \"versionEndExcluding\": \"6.1.132\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.3\", \"versionEndExcluding\": \"6.6.84\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.3\", \"versionEndExcluding\": \"6.12.20\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.3\", \"versionEndExcluding\": \"6.13.8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.3\", \"versionEndExcluding\": \"6.14\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.14.308\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.19.276\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2.3\"}]}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d509c4731090ebd9bbdb72c70a2d70003ae81f4f\"}, {\"url\": \"https://git.kernel.org/stable/c/985a536e04bbfffb1770df43c6470f635a6b1073\"}, {\"url\": \"https://git.kernel.org/stable/c/18b5d857c6496b78ead2fd10001b81ae32d30cac\"}, {\"url\": \"https://git.kernel.org/stable/c/ec52240622c4d218d0240079b7c1d3ec2328a9f4\"}, {\"url\": \"https://git.kernel.org/stable/c/e686349cc19e800dac8971929089ba5ff59abfb0\"}, {\"url\": \"https://git.kernel.org/stable/c/488ffc0cac38f203979f83634236ee53251ce593\"}, {\"url\": \"https://git.kernel.org/stable/c/5ac295dfccb5b015493f86694fa13a0dde4d3665\"}, {\"url\": \"https://git.kernel.org/stable/c/e3e89178a9f4a80092578af3ff3c8478f9187d59\"}], \"title\": \"x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes\", \"x_generator\": {\"engine\": \"bippy-1.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21991\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T17:13:39.419226Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-129\", \"description\": \"CWE-129 Improper Validation of Array Index\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T14:39:04.408Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21991\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2024-12-29T08:45:45.800Z\", \"datePublished\": \"2025-04-02T12:53:14.230Z\", \"dateUpdated\": \"2025-10-01T17:13:42.269Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.