CVE-2025-21650

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21650", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.728Z", "datePublished": "2025-01-19T10:18:07.976Z", "dateUpdated": "2026-10-21T12:35:53.165Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:35:53.165Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue\n\nThe TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs\n1024-1279 are in different BAR space addresses. However,\nhclge_fetch_pf_reg does not distinguish the tqp space information when\nreading the tqp space information. When the number of TQPs is greater\nthan 1024, access bar space overwriting occurs.\nThe problem of different segments has been considered during the\ninitialization of tqp.io_base. Therefore, tqp.io_base is directly used\nwhen the queue is read in hclge_fetch_pf_reg.\n\nThe error message:\n\nUnable to handle kernel paging request at virtual address ffff800037200000\npc : hclge_fetch_pf_reg+0x138/0x250 [hclge]\nlr : hclge_get_regs+0x84/0x1d0 [hclge]\nCall trace:\n hclge_fetch_pf_reg+0x138/0x250 [hclge]\n hclge_get_regs+0x84/0x1d0 [hclge]\n hns3_get_regs+0x2c/0x50 [hns3]\n ethtool_get_regs+0xf4/0x270\n dev_ethtool+0x674/0x8a0\n dev_ioctl+0x270/0x36c\n sock_do_ioctl+0x110/0x2a0\n sock_ioctl+0x2ac/0x530\n __arm64_sys_ioctl+0xa8/0x100\n invoke_syscall+0x4c/0x124\n el0_svc_common.constprop.0+0x140/0x15c\n do_el0_svc+0x30/0xd0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xb0/0xb4\n el0_sync+0x168/0x180"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The only route to the vulnerable code is a local `ioctl(SIOCETHTOOL, ETHTOOL_GREGS)` on a socket, as shown by the commit's own call trace (`__arm64_sys_ioctl` \u2192 `sock_ioctl` \u2192 `dev_ethtool` \u2192 `hclge_fetch_pf_reg`). No remote or adjacent-network input reaches this path.\nAC:L - On an affected HNS3 PF (\u22651024 TQPs assigned to the PF vport, which is the default when SR-IOV is not enabled), a single `ethtool -d ethX` deterministically walks past the end of the BAR2 mapping; there is no race, no memory-layout dependency, and no state the attacker cannot arrange.\nPR:L - `ETHTOOL_GREGS` is gated on `ns_capable(net->user_ns, CAP_NET_ADMIN)`, not on real root \u2014 a non-root telemetry/monitoring process holding only `cap_net_admin+ep`, or a container process with CAP_NET_ADMIN over a delegated network namespace holding the hns3 netdev, can reach it without any administrative account.\nUI:N - The attacker issues the ethtool ioctl directly; no victim action, mount, or file open is required.\nS:U - The out-of-bounds MMIO access and its consequences are entirely contained within the kernel of the same host, with no crossing of a VM, IOMMU, or sandbox authority boundary.\nC:H - The defect is an out-of-bounds read spanning up to ~128 KB beyond the ioremapped BAR2 window, and every value read is copied straight to userspace by `ethtool_get_regs()` \u2014 far beyond a \"few bounded bytes\", so on BAR layouts where the accesses do not immediately fault it discloses register/MMIO content the caller was never meant to see.\nI:N - The destination buffer is correctly sized by `hclge_get_regs_len()` using the same `kinfo->num_tqps`, so there is no out-of-bounds write; the erroneous accesses are read-only MMIO loads with no attacker-controlled modification of kernel state.\nA:H - The first out-of-bounds access lands on unmapped vmalloc space, producing the \"Unable to handle kernel paging request at virtual address ffff800037200000\" oops recorded in the fix commit \u2014 a kernel crash that any permitted caller can trigger repeatedly."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c", "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c"], "versions": [{"version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "lessThan": "a85246635466752b9af72188e4a839541120d952", "status": "affected", "versionType": "git"}, {"version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "lessThan": "0575baa733fc4219f230aef22d5bc35d922f1e9a", "status": "affected", "versionType": "git"}, {"version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "lessThan": "7997ddd46c54408bcba5e37fe18b4d832e45d4d4", "status": "affected", "versionType": "git"}, {"version": "df34972a33d268a7113c119fe4e4b07a6819aa0c", "status": "affected", "versionType": "git"}, {"version": "2b1fff96a297034f03466cfecda9824adafe16ed", "status": "affected", "versionType": "git"}, {"version": "6.4.16", "lessThan": "6.5", "status": "affected", "versionType": "semver"}, {"version": "6.5.3", "lessThan": "6.6", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c", "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.10", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a85246635466752b9af72188e4a839541120d952"}, {"url": "https://git.kernel.org/stable/c/0575baa733fc4219f230aef22d5bc35d922f1e9a"}, {"url": "https://git.kernel.org/stable/c/7997ddd46c54408bcba5e37fe18b4d832e45d4d4"}], "title": "net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21650", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-01T19:53:49.493416Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:57:16.978Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21650", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-01T19:53:49.493416Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T15:55:56.524Z"}}], "cna": {"title": "net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The only route to the vulnerable code is a local `ioctl(SIOCETHTOOL, ETHTOOL_GREGS)` on a socket, as shown by the commit's own call trace (`__arm64_sys_ioctl` \u2192 `sock_ioctl` \u2192 `dev_ethtool` \u2192 `hclge_fetch_pf_reg`). No remote or adjacent-network input reaches this path.\nAC:L - On an affected HNS3 PF (\u22651024 TQPs assigned to the PF vport, which is the default when SR-IOV is not enabled), a single `ethtool -d ethX` deterministically walks past the end of the BAR2 mapping; there is no race, no memory-layout dependency, and no state the attacker cannot arrange.\nPR:L - `ETHTOOL_GREGS` is gated on `ns_capable(net->user_ns, CAP_NET_ADMIN)`, not on real root \u2014 a non-root telemetry/monitoring process holding only `cap_net_admin+ep`, or a container process with CAP_NET_ADMIN over a delegated network namespace holding the hns3 netdev, can reach it without any administrative account.\nUI:N - The attacker issues the ethtool ioctl directly; no victim action, mount, or file open is required.\nS:U - The out-of-bounds MMIO access and its consequences are entirely contained within the kernel of the same host, with no crossing of a VM, IOMMU, or sandbox authority boundary.\nC:H - The defect is an out-of-bounds read spanning up to ~128 KB beyond the ioremapped BAR2 window, and every value read is copied straight to userspace by `ethtool_get_regs()` \u2014 far beyond a \"few bounded bytes\", so on BAR layouts where the accesses do not immediately fault it discloses register/MMIO content the caller was never meant to see.\nI:N - The destination buffer is correctly sized by `hclge_get_regs_len()` using the same `kinfo->num_tqps`, so there is no out-of-bounds write; the erroneous accesses are read-only MMIO loads with no attacker-controlled modification of kernel state.\nA:H - The first out-of-bounds access lands on unmapped vmalloc space, producing the \"Unable to handle kernel paging request at virtual address ffff800037200000\" oops recorded in the fix commit \u2014 a kernel crash that any permitted caller can trigger repeatedly."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "lessThan": "a85246635466752b9af72188e4a839541120d952", "versionType": "git"}, {"status": "affected", "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "lessThan": "0575baa733fc4219f230aef22d5bc35d922f1e9a", "versionType": "git"}, {"status": "affected", "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "lessThan": "7997ddd46c54408bcba5e37fe18b4d832e45d4d4", "versionType": "git"}, {"status": "affected", "version": "df34972a33d268a7113c119fe4e4b07a6819aa0c", "versionType": "git"}, {"status": "affected", "version": "2b1fff96a297034f03466cfecda9824adafe16ed", "versionType": "git"}, {"status": "affected", "version": "6.4.16", "lessThan": "6.5", "versionType": "semver"}, {"status": "affected", "version": "6.5.3", "lessThan": "6.6", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c", "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"status": "unaffected", "version": "0", "lessThan": "6.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.10", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c", "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a85246635466752b9af72188e4a839541120d952"}, {"url": "https://git.kernel.org/stable/c/0575baa733fc4219f230aef22d5bc35d922f1e9a"}, {"url": "https://git.kernel.org/stable/c/7997ddd46c54408bcba5e37fe18b4d832e45d4d4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue\n\nThe TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs\n1024-1279 are in different BAR space addresses. However,\nhclge_fetch_pf_reg does not distinguish the tqp space information when\nreading the tqp space information. When the number of TQPs is greater\nthan 1024, access bar space overwriting occurs.\nThe problem of different segments has been considered during the\ninitialization of tqp.io_base. Therefore, tqp.io_base is directly used\nwhen the queue is read in hclge_fetch_pf_reg.\n\nThe error message:\n\nUnable to handle kernel paging request at virtual address ffff800037200000\npc : hclge_fetch_pf_reg+0x138/0x250 [hclge]\nlr : hclge_get_regs+0x84/0x1d0 [hclge]\nCall trace:\n hclge_fetch_pf_reg+0x138/0x250 [hclge]\n hclge_get_regs+0x84/0x1d0 [hclge]\n hns3_get_regs+0x2c/0x50 [hns3]\n ethtool_get_regs+0xf4/0x270\n dev_ethtool+0x674/0x8a0\n dev_ioctl+0x270/0x36c\n sock_do_ioctl+0x110/0x2a0\n sock_ioctl+0x2ac/0x530\n __arm64_sys_ioctl+0xa8/0x100\n invoke_syscall+0x4c/0x124\n el0_svc_common.constprop.0+0x140/0x15c\n do_el0_svc+0x30/0xd0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xb0/0xb4\n el0_sync+0x168/0x180"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.10", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.4.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.5.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:35:53.165Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21650", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:35:53.165Z", "dateReserved": "2024-12-29T08:45:45.728Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-01-19T10:18:07.976Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c", "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a85246635466752b9af72188e4a839541120d952", "status": "affected", "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "versionType": "git"}, {"lessThan": "0575baa733fc4219f230aef22d5bc35d922f1e9a", "status": "affected", "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "versionType": "git"}, {"lessThan": "7997ddd46c54408bcba5e37fe18b4d832e45d4d4", "status": "affected", "version": "939ccd107ffcade20c9c7055a2e7ae0fd724fb72", "versionType": "git"}, {"status": "affected", "version": "df34972a33d268a7113c119fe4e4b07a6819aa0c", "versionType": "git"}, {"status": "affected", "version": "2b1fff96a297034f03466cfecda9824adafe16ed", "versionType": "git"}, {"lessThan": "6.5", "status": "affected", "version": "6.4.16", "versionType": "semver"}, {"lessThan": "6.6", "status": "affected", "version": "6.5.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_regs.c", "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_regs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5099559-2D15-42A5-A561-71B34FEFF36F", "versionEndExcluding": "6.5", "versionStartIncluding": "6.4.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "027A0A90-C67C-4EB4-8FF4-E9701C342DF8", "versionEndExcluding": "6.12.10", "versionStartIncluding": "6.5.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*", "matchCriteriaId": "93C0660D-7FB8-4FBA-892A-B064BA71E49E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*", "matchCriteriaId": "034C36A6-C481-41F3-AE9A-D116E5BE6895", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*", "matchCriteriaId": "8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue\n\nThe TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs\n1024-1279 are in different BAR space addresses. However,\nhclge_fetch_pf_reg does not distinguish the tqp space information when\nreading the tqp space information. When the number of TQPs is greater\nthan 1024, access bar space overwriting occurs.\nThe problem of different segments has been considered during the\ninitialization of tqp.io_base. Therefore, tqp.io_base is directly used\nwhen the queue is read in hclge_fetch_pf_reg.\n\nThe error message:\n\nUnable to handle kernel paging request at virtual address ffff800037200000\npc : hclge_fetch_pf_reg+0x138/0x250 [hclge]\nlr : hclge_get_regs+0x84/0x1d0 [hclge]\nCall trace:\n hclge_fetch_pf_reg+0x138/0x250 [hclge]\n hclge_get_regs+0x84/0x1d0 [hclge]\n hns3_get_regs+0x2c/0x50 [hns3]\n ethtool_get_regs+0xf4/0x270\n dev_ethtool+0x674/0x8a0\n dev_ioctl+0x270/0x36c\n sock_do_ioctl+0x110/0x2a0\n sock_ioctl+0x2ac/0x530\n __arm64_sys_ioctl+0xa8/0x100\n invoke_syscall+0x4c/0x124\n el0_svc_common.constprop.0+0x140/0x15c\n do_el0_svc+0x30/0xd0\n el0_svc+0x1c/0x2c\n el0_sync_handler+0xb0/0xb4\n el0_sync+0x168/0x180"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net:hns3: se ha corregido el problema de que hclge_fetch_pf_reg accede al espacio de la barra fuera de los l\u00edmites El espacio BAR de TQP se divide en dos segmentos. Los TQP 0-1023 y los TQP 1024-1279 est\u00e1n en diferentes direcciones de espacio BAR. Sin embargo, hclge_fetch_pf_reg no distingue la informaci\u00f3n del espacio tqp al leer la informaci\u00f3n del espacio tqp. Cuando el n\u00famero de TQP es mayor que 1024, se produce una sobrescritura del espacio de la barra de acceso. El problema de los diferentes segmentos se ha considerado durante la inicializaci\u00f3n de tqp.io_base. Por lo tanto, tqp.io_base se utiliza directamente cuando se lee la cola en hclge_fetch_pf_reg. Mensaje de error: No se puede gestionar la solicitud de paginaci\u00f3n del n\u00facleo en la direcci\u00f3n virtual ffff800037200000 pc : hclge_fetch_pf_reg+0x138/0x250 [hclge] lr : hclge_get_regs+0x84/0x1d0 [hclge] Call trace: hclge_fetch_pf_reg+0x138/0x250 [hclge] hclge_get_regs+0x84/0x1d0 [hclge] hns3_get_regs+0x2c/0x50 [hns3] ethtool_get_regs+0xf4/0x270 dev_ethtool+0x674/0x8a0 dev_ioctl+0x270/0x36c sock_do_ioctl+0x110/0x2a0 sock_ioctl+0x2ac/0x530 __arm64_sys_ioctl+0xa8/0x100 invoke_syscall+0x4c/0x124 el0_svc_common.constprop.0+0x140/0x15c do_el0_svc+0x30/0xd0 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180 "}], "id": "CVE-2025-21650", "lastModified": "2026-10-21T13:17:54.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21650", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T19:53:49.493416Z", "version": "2.0.3"}}]}, "published": "2025-01-19T11:15:10.630", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0575baa733fc4219f230aef22d5bc35d922f1e9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7997ddd46c54408bcba5e37fe18b4d832e45d4d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a85246635466752b9af72188e4a839541120d952"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue", "id": "2338831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338831"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue\nThe TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs\n1024-1279 are in different BAR space addresses. However,\nhclge_fetch_pf_reg does not distinguish the tqp space information when\nreading the tqp space information. When the number of TQPs is greater\nthan 1024, access bar space overwriting occurs.\nThe problem of different segments has been considered during the\ninitialization of tqp.io_base. Therefore, tqp.io_base is directly used\nwhen the queue is read in hclge_fetch_pf_reg.\nThe error message:\nUnable to handle kernel paging request at virtual address ffff800037200000\npc : hclge_fetch_pf_reg+0x138/0x250 [hclge]\nlr : hclge_get_regs+0x84/0x1d0 [hclge]\nCall trace:\nhclge_fetch_pf_reg+0x138/0x250 [hclge]\nhclge_get_regs+0x84/0x1d0 [hclge]\nhns3_get_regs+0x2c/0x50 [hns3]\nethtool_get_regs+0xf4/0x270\ndev_ethtool+0x674/0x8a0\ndev_ioctl+0x270/0x36c\nsock_do_ioctl+0x110/0x2a0\nsock_ioctl+0x2ac/0x530\n__arm64_sys_ioctl+0xa8/0x100\ninvoke_syscall+0x4c/0x124\nel0_svc_common.constprop.0+0x140/0x15c\ndo_el0_svc+0x30/0xd0\nel0_svc+0x1c/0x2c\nel0_sync_handler+0xb0/0xb4\nel0_sync+0x168/0x180"], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-21650", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-01-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21650\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21650\nhttps://lore.kernel.org/linux-cve-announce/2025011946-CVE-2025-21650-3a74@gregkh/T"], "statement": "The issue only arises when the number of Transmit Queue Pairs (TQPs) exceeds 1024, which may not apply to all hardware configurations or typical use cases. Additionally, the vulnerability triggers an out-of-bounds access in the BAR space during register retrieval operations, such as those invoked by `ethtool`. This means the issue is not to be exploitable remotely, and limited to administrative tasks by privileged users. \nRed Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}