CVE-2025-21832

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21832
In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (where bigger than makes more sense), and not checking the return value of blkdev_direct_IO() before doing an iov_iter_revert(). The latter can lead to attempting to revert with a negative value, which when passed to iov_iter_revert() as an unsigned value will lead to throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT. Be sane and don't revert for -EIOCBQUEUED, like what is done in other spots.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/68f16d3034a06661245ecd22f0d586a8b4e7c473 Patch
https://git.kernel.org/stable/c/6c26619effb1b4cb7d20b4e666ab8f71f6a53ccb Patch
https://git.kernel.org/stable/c/84671b0630ccb46ae9f1f99a45c7d63ffcd6a474 Patch
https://git.kernel.org/stable/c/a58f136bad29f9ae721a29d98c042fddbee22f77 Patch
https://git.kernel.org/stable/c/b13ee668e8280ca5b07f8ce2846b9957a8a10853 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:*
History

29 Oct 2025, 20:58

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloque: no revertir iter para -EIOCBQUEUED blkdev_read_iter() tiene algunas comprobaciones extrañas, como bloquear el ajuste de posición y conteo en función de si el resultado es o no mayor o igual a cero (donde mayor que tiene más sentido), y no verificar el valor de retorno de blkdev_direct_IO() antes de hacer un iov_iter_revert(). Esto último puede llevar a intentar revertir con un valor negativo, que cuando se pasa a iov_iter_revert() como un valor sin signo conducirá a lanzar un WARN_ON() porque unroll es mayor que MAX_RW_COUNT. Sea sensato y no revierta para -EIOCBQUEUED, como lo que se hace en otros lugares.
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/68f16d3034a06661245ecd22f0d586a8b4e7c473 - () https://git.kernel.org/stable/c/68f16d3034a06661245ecd22f0d586a8b4e7c473 - Patch
References () https://git.kernel.org/stable/c/6c26619effb1b4cb7d20b4e666ab8f71f6a53ccb - () https://git.kernel.org/stable/c/6c26619effb1b4cb7d20b4e666ab8f71f6a53ccb - Patch
References () https://git.kernel.org/stable/c/84671b0630ccb46ae9f1f99a45c7d63ffcd6a474 - () https://git.kernel.org/stable/c/84671b0630ccb46ae9f1f99a45c7d63ffcd6a474 - Patch
References () https://git.kernel.org/stable/c/a58f136bad29f9ae721a29d98c042fddbee22f77 - () https://git.kernel.org/stable/c/a58f136bad29f9ae721a29d98c042fddbee22f77 - Patch
References () https://git.kernel.org/stable/c/b13ee668e8280ca5b07f8ce2846b9957a8a10853 - () https://git.kernel.org/stable/c/b13ee668e8280ca5b07f8ce2846b9957a8a10853 - Patch

06 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-06 17:15

Updated : 2025-10-29 20:58

NVD link : CVE-2025-21832

Mitre link : CVE-2025-21832

CVE.ORG link : CVE-2025-21832

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo