Vulnerability-Lookup

CVE-2025-21916 (GCVE-0-2025-21916)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:40 – Updated: 2026-05-23 15:57

Title

usb: atm: cxacru: fix a flaw in existing endpoint checks

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix a flaw in existing endpoint checks Syzbot once again identified a flaw in usb endpoint checking, see [1]. This time the issue stems from a commit authored by me (2eabb655a968 ("usb: atm: cxacru: fix endpoint checking in cxacru_bind()")). While using usb_find_common_endpoints() may usually be enough to discard devices with wrong endpoints, in this case one needs more than just finding and identifying the sufficient number of endpoints of correct types - one needs to check the endpoint's address as well. Since cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind, switch the endpoint verification approach to usb_check_XXX_endpoints() instead to fix incomplete ep testing. [1] Syzbot report: usb 5-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... RIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649 cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline] cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223 usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058 cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377 usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396 really_probe+0x2b9/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 ...

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/dcd592ab9dd8a2bfc…
https://git.kernel.org/stable/c/319529e0356bd9045…
https://git.kernel.org/stable/c/bf4409f84023b52b5…
https://git.kernel.org/stable/c/197e78076c5ecd895…
https://git.kernel.org/stable/c/a0475a885d69849b1…
https://git.kernel.org/stable/c/cfc295f7cccf66cbd…
https://git.kernel.org/stable/c/903b80c21458bb1e3…
https://git.kernel.org/stable/c/c90aad369899a607c…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 23926d316d2836315cb113569f91393266eb5b47 , < dcd592ab9dd8a2bfc36e75583b9006db2a77ec24 (git) Affected: 75ddbf776dd04a09fb9e5267ead5d0c989f84506 , < 319529e0356bd904528c64647725a2272d297c83 (git) Affected: 1aac4be1aaa5177506219f01dce5e29194e5e95a , < bf4409f84023b52b5e9b36c0a071a121eee42138 (git) Affected: 5584c776a1af7807ca815ee6265f2c1429fc5727 , < 197e78076c5ecd895f109158c4ea2954b9919af6 (git) Affected: f536f09eb45e4de8d1b9accee9d992aa1846f1d4 , < a0475a885d69849b1ade38add6d64338dfa83a8f (git) Affected: 2eabb655a968b862bc0c31629a09f0fbf3c80d51 , < cfc295f7cccf66cbd5123416bcf1bee2e1bd37de (git) Affected: 2eabb655a968b862bc0c31629a09f0fbf3c80d51 , < 903b80c21458bb1e34c3a78c5fdc553821e357f8 (git) Affected: 2eabb655a968b862bc0c31629a09f0fbf3c80d51 , < c90aad369899a607cfbc002bebeafd51e31900cd (git) Affected: 5159a81924311c1ec786ad9fdef784ead8676a6a (git) Affected: ac9007520e392541a29daebaae8b9109007bc781 (git) Affected: 5.4.279 , < 5.4.291 (semver) Affected: 5.10.221 , < 5.10.235 (semver) Affected: 5.15.162 , < 5.15.179 (semver) Affected: 6.1.97 , < 6.1.131 (semver) Affected: 6.6.37 , < 6.6.83 (semver) Affected: 4.19.317 , < 4.20 (semver) Affected: 6.9.8 , < 6.10 (semver)	guessed
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.131 , ≤ 6.1.* (semver) Unaffected: 6.6.83 , ≤ 6.6.* (semver) Unaffected: 6.12.19 , ≤ 6.12.* (semver) Unaffected: 6.13.7 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:39:05.568Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/cxacru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dcd592ab9dd8a2bfc36e75583b9006db2a77ec24",
              "status": "affected",
              "version": "23926d316d2836315cb113569f91393266eb5b47",
              "versionType": "git"
            },
            {
              "lessThan": "319529e0356bd904528c64647725a2272d297c83",
              "status": "affected",
              "version": "75ddbf776dd04a09fb9e5267ead5d0c989f84506",
              "versionType": "git"
            },
            {
              "lessThan": "bf4409f84023b52b5e9b36c0a071a121eee42138",
              "status": "affected",
              "version": "1aac4be1aaa5177506219f01dce5e29194e5e95a",
              "versionType": "git"
            },
            {
              "lessThan": "197e78076c5ecd895f109158c4ea2954b9919af6",
              "status": "affected",
              "version": "5584c776a1af7807ca815ee6265f2c1429fc5727",
              "versionType": "git"
            },
            {
              "lessThan": "a0475a885d69849b1ade38add6d64338dfa83a8f",
              "status": "affected",
              "version": "f536f09eb45e4de8d1b9accee9d992aa1846f1d4",
              "versionType": "git"
            },
            {
              "lessThan": "cfc295f7cccf66cbd5123416bcf1bee2e1bd37de",
              "status": "affected",
              "version": "2eabb655a968b862bc0c31629a09f0fbf3c80d51",
              "versionType": "git"
            },
            {
              "lessThan": "903b80c21458bb1e34c3a78c5fdc553821e357f8",
              "status": "affected",
              "version": "2eabb655a968b862bc0c31629a09f0fbf3c80d51",
              "versionType": "git"
            },
            {
              "lessThan": "c90aad369899a607cfbc002bebeafd51e31900cd",
              "status": "affected",
              "version": "2eabb655a968b862bc0c31629a09f0fbf3c80d51",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5159a81924311c1ec786ad9fdef784ead8676a6a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac9007520e392541a29daebaae8b9109007bc781",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.291",
              "status": "affected",
              "version": "5.4.279",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.235",
              "status": "affected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.179",
              "status": "affected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.131",
              "status": "affected",
              "version": "6.1.97",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.83",
              "status": "affected",
              "version": "6.6.37",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.317",
              "versionType": "semver"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/cxacru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "5.4.279",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.10.221",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.15.162",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.131",
                  "versionStartIncluding": "6.1.97",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.83",
                  "versionStartIncluding": "6.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.317",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: cxacru: fix a flaw in existing endpoint checks\n\nSyzbot once again identified a flaw in usb endpoint checking, see [1].\nThis time the issue stems from a commit authored by me (2eabb655a968\n(\"usb: atm: cxacru: fix endpoint checking in cxacru_bind()\")).\n\nWhile using usb_find_common_endpoints() may usually be enough to\ndiscard devices with wrong endpoints, in this case one needs more\nthan just finding and identifying the sufficient number of endpoints\nof correct types - one needs to check the endpoint\u0027s address as well.\n\nSince cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind,\nswitch the endpoint verification approach to usb_check_XXX_endpoints()\ninstead to fix incomplete ep testing.\n\n[1] Syzbot report:\nusb 5-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503\n...\nRIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503\n...\nCall Trace:\n \u003cTASK\u003e\n cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649\n cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline]\n cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223\n usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058\n cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377\n usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396\n really_probe+0x2b9/0xad0 drivers/base/dd.c:658\n __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800\n driver_probe_device+0x50/0x430 drivers/base/dd.c:830\n..."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:57:26.891Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dcd592ab9dd8a2bfc36e75583b9006db2a77ec24"
        },
        {
          "url": "https://git.kernel.org/stable/c/319529e0356bd904528c64647725a2272d297c83"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf4409f84023b52b5e9b36c0a071a121eee42138"
        },
        {
          "url": "https://git.kernel.org/stable/c/197e78076c5ecd895f109158c4ea2954b9919af6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0475a885d69849b1ade38add6d64338dfa83a8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfc295f7cccf66cbd5123416bcf1bee2e1bd37de"
        },
        {
          "url": "https://git.kernel.org/stable/c/903b80c21458bb1e34c3a78c5fdc553821e357f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c90aad369899a607cfbc002bebeafd51e31900cd"
        }
      ],
      "title": "usb: atm: cxacru: fix a flaw in existing endpoint checks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21916",
    "datePublished": "2025-04-01T15:40:52.519Z",
    "dateReserved": "2024-12-29T08:45:45.787Z",
    "dateUpdated": "2026-05-23T15:57:26.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21916",
      "date": "2026-09-17",
      "epss": "0.00221",
      "percentile": "0.12771"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21916\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:22.223\",\"lastModified\":\"2026-06-17T08:44:36.170\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: atm: cxacru: fix a flaw in existing endpoint checks\\n\\nSyzbot once again identified a flaw in usb endpoint checking, see [1].\\nThis time the issue stems from a commit authored by me (2eabb655a968\\n(\\\"usb: atm: cxacru: fix endpoint checking in cxacru_bind()\\\")).\\n\\nWhile using usb_find_common_endpoints() may usually be enough to\\ndiscard devices with wrong endpoints, in this case one needs more\\nthan just finding and identifying the sufficient number of endpoints\\nof correct types - one needs to check the endpoint\u0027s address as well.\\n\\nSince cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind,\\nswitch the endpoint verification approach to usb_check_XXX_endpoints()\\ninstead to fix incomplete ep testing.\\n\\n[1] Syzbot report:\\nusb 5-1: BOGUS urb xfer, pipe 3 != type 1\\nWARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503\\n...\\nRIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649\\n cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline]\\n cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223\\n usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058\\n cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377\\n usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396\\n really_probe+0x2b9/0xad0 drivers/base/dd.c:658\\n __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800\\n driver_probe_device+0x50/0x430 drivers/base/dd.c:830\\n...\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: atm: cxacru: corrige un fallo en las comprobaciones de endpoints existentes Syzbot volvi\u00f3 a identificar un fallo en la comprobaci\u00f3n de endpoints USB, consulte [1]. Esta vez, el problema se debe a una confirmaci\u00f3n de mi autor\u00eda (2eabb655a968 (\\\"usb: atm: cxacru: fix endpoint checking in cxacru_bind()\\\")). Si bien usar usb_find_common_endpoints() suele ser suficiente para descartar dispositivos con endpoints err\u00f3neos, en este caso se necesita m\u00e1s que simplemente encontrar e identificar la cantidad suficiente de endpoints de los tipos correctos: tambi\u00e9n se necesita comprobar la direcci\u00f3n del endpoint. Dado que cxacru_bind() rellena las URB teniendo en cuenta la direcci\u00f3n CXACRU_EP_CMD, cambie el enfoque de verificaci\u00f3n de endpoints a usb_check_XXX_endpoints() para corregir las pruebas de EP incompletas. [1] Informe de Syzbot: usb 5-1: transferencia de urb FALSA, canal 3 != tipo 1 ADVERTENCIA: CPU: 0 PID: 1378 en drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... RIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Seguimiento de llamadas  cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649 cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline] cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223 usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058 cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377 usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396 really_probe+0x2b9/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 ... \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/atm/cxacru.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"23926d316d2836315cb113569f91393266eb5b47\",\"lessThan\":\"dcd592ab9dd8a2bfc36e75583b9006db2a77ec24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"75ddbf776dd04a09fb9e5267ead5d0c989f84506\",\"lessThan\":\"319529e0356bd904528c64647725a2272d297c83\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1aac4be1aaa5177506219f01dce5e29194e5e95a\",\"lessThan\":\"bf4409f84023b52b5e9b36c0a071a121eee42138\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5584c776a1af7807ca815ee6265f2c1429fc5727\",\"lessThan\":\"197e78076c5ecd895f109158c4ea2954b9919af6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f536f09eb45e4de8d1b9accee9d992aa1846f1d4\",\"lessThan\":\"a0475a885d69849b1ade38add6d64338dfa83a8f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2eabb655a968b862bc0c31629a09f0fbf3c80d51\",\"lessThan\":\"cfc295f7cccf66cbd5123416bcf1bee2e1bd37de\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2eabb655a968b862bc0c31629a09f0fbf3c80d51\",\"lessThan\":\"903b80c21458bb1e34c3a78c5fdc553821e357f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2eabb655a968b862bc0c31629a09f0fbf3c80d51\",\"lessThan\":\"c90aad369899a607cfbc002bebeafd51e31900cd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5159a81924311c1ec786ad9fdef784ead8676a6a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ac9007520e392541a29daebaae8b9109007bc781\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.279\",\"lessThan\":\"5.4.291\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.221\",\"lessThan\":\"5.10.235\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.162\",\"lessThan\":\"5.15.179\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.97\",\"lessThan\":\"6.1.131\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.37\",\"lessThan\":\"6.6.83\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.317\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.9.8\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/atm/cxacru.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.291\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.235\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.179\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.131\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.83\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.19\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.7\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.317\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"DBCC7CEA-15C0-47C4-8D3B-10F7FF0BEBA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.279\",\"versionEndExcluding\":\"5.4.291\",\"matchCriteriaId\":\"11E1BD30-3F97-4B56-AD8B-8751ED8233DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.221\",\"versionEndExcluding\":\"5.10.235\",\"matchCriteriaId\":\"9ADA7F30-C6AB-44C5-9C83-366990952EDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.162\",\"versionEndExcluding\":\"5.15.179\",\"matchCriteriaId\":\"F1288D06-ABD9-47BA-AFEB-6A9D2807184C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.97\",\"versionEndExcluding\":\"6.1.131\",\"matchCriteriaId\":\"D11897AA-E2F8-40BC-98C0-6383FEF2E533\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.37\",\"versionEndExcluding\":\"6.6.83\",\"matchCriteriaId\":\"22711759-DA6C-40DE-827E-415E75B86CF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.8\",\"versionEndExcluding\":\"6.10\",\"matchCriteriaId\":\"7CD11465-AFC4-428F-A933-C8F6486DDC2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.1\",\"versionEndExcluding\":\"6.12.19\",\"matchCriteriaId\":\"1F265CB5-9202-4B16-ACEA-45BEDFBF2FBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.7\",\"matchCriteriaId\":\"842F5A44-3E71-4546-B4FD-43B0ACE3F32B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EA80796-744E-45F5-8632-2AB4F7889FCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F3E9E0C-AC3E-4967-AF80-6483E8AB0078\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"11AF4CB9-F697-4EA4-8903-8F9417EFDA8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/197e78076c5ecd895f109158c4ea2954b9919af6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/319529e0356bd904528c64647725a2272d297c83\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/903b80c21458bb1e34c3a78c5fdc553821e357f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a0475a885d69849b1ade38add6d64338dfa83a8f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bf4409f84023b52b5e9b36c0a071a121eee42138\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c90aad369899a607cfbc002bebeafd51e31900cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cfc295f7cccf66cbd5123416bcf1bee2e1bd37de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dcd592ab9dd8a2bfc36e75583b9006db2a77ec24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:32:39+00:00",
      "cve": "CVE-2025-21916",
      "id": "CVE-2025-21916",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: atm: cxacru: fix a flaw in existing endpoint checks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21916.json",
      "version": "3"
    }
  }
}

oesa-2025-1512

Vulnerability from osv_openeuler

Published

2025-05-16 11:08

Modified

2026-08-06 11:08

Summary

kernel security update

Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

usb: atm: cxacru: fix a flaw in existing endpoint checks

Syzbot once again identified a flaw in usb endpoint checking, see [1]. This time the issue stems from a commit authored by me (2eabb655a968 ("usb: atm: cxacru: fix endpoint checking in cxacru_bind()")).

While using usb_find_common_endpoints() may usually be enough to discard devices with wrong endpoints, in this case one needs more than just finding and identifying the sufficient number of endpoints of correct types - one needs to check the endpoint's address as well.

Since cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind, switch the endpoint verification approach to usb_check_XXX_endpoints() instead to fix incomplete ep testing.

[1] Syzbot report: usb 5-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... RIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649 cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline] cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223 usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058 cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377 usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396 really_probe+0x2b9/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 ...(CVE-2025-21916)

In the Linux kernel, the following vulnerability has been resolved:

drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl

In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", which are then copied to user space. The initializer is indeed implemented in "acrn_hypercall2" (arch/x86/include/asm/acrn.h). There is a risk of information leakage due to uninitialized bytes.(CVE-2025-21950)

In the Linux kernel, the following vulnerability has been resolved:

backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()

Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ...

Indeed, led_sysfs_enable() has to be called with the led_access lock held.

Hold the lock when calling led_sysfs_disable().(CVE-2025-23144)

In the Linux kernel, the following vulnerability has been resolved:

jfs: Fix uninit-value access of imap allocated in the diMount() function

syzbot reports that hex_dump_to_buffer is using uninit-value:

===================================================== BUG: KMSAN: uninit-value in hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171 hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171 print_hex_dump+0x13d/0x3e0 lib/hexdump.c:276 diFree+0x5ba/0x4350 fs/jfs/jfs_imap.c:876 jfs_evict_inode+0x510/0x550 fs/jfs/inode.c:156 evict+0x723/0xd10 fs/inode.c:796 iput_final fs/inode.c:1946 [inline] iput+0x97b/0xdb0 fs/inode.c:1972 txUpdateMap+0xf3e/0x1150 fs/jfs/jfs_txnmgr.c:2367 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x627/0x11d0 fs/jfs/jfs_txnmgr.c:2733 kthread+0x6b9/0xef0 kernel/kthread.c:464 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at: slab_post_alloc_hook mm/slub.c:4121 [inline] slab_alloc_node mm/slub.c:4164 [inline] __kmalloc_cache_noprof+0x8e3/0xdf0 mm/slub.c:4320 kmalloc_noprof include/linux/slab.h:901 [inline] diMount+0x61/0x7f0 fs/jfs/jfs_imap.c:105 jfs_mount+0xa8e/0x11d0 fs/jfs/jfs_mount.c:176 jfs_fill_super+0xa47/0x17c0 fs/jfs/super.c:523 get_tree_bdev_flags+0x6ec/0x910 fs/super.c:1636 get_tree_bdev+0x37/0x50 fs/super.c:1659 jfs_get_tree+0x34/0x40 fs/jfs/super.c:635 vfs_get_tree+0xb1/0x5a0 fs/super.c:1814 do_new_mount+0x71f/0x15e0 fs/namespace.c:3560 path_mount+0x742/0x1f10 fs/namespace.c:3887 do_mount fs/namespace.c:3900 [inline] __do_sys_mount fs/namespace.c:4111 [inline] __se_sys_mount+0x71f/0x800 fs/namespace.c:4088 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4088 x64_sys_call+0x39bf/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:166 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f =====================================================

The reason is that imap is not properly initialized after memory allocation. It will cause the snprintf() function to write uninitialized data into linebuf within hex_dump_to_buffer().

Fix this by using kzalloc instead of kmalloc to clear its content at the beginning in diMount().(CVE-2025-37742)

In the Linux kernel, the following vulnerability has been resolved:

net: libwx: handle page_pool_dev_alloc_pages error

page_pool_dev_alloc_pages could return NULL. There was a WARN_ON(!page) but it would still proceed to use the NULL pointer and then crash.

This is similar to commit 001ba0902046 ("net: fec: handle page_pool_dev_alloc_pages error").

This is found by our static analysis tool KNighter.(CVE-2025-37755)

In the Linux kernel, the following vulnerability has been resolved:

vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp

vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes).

We noticed MTU-related connectivity issues with Cilium's service load- balancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP backend service where the XDP LB was doing IPIP encap led to overly large packet sizes but only for some of the packets (e.g. HTTP GET request) while others (e.g. the prior TCP 3WHS) looked completely fine on the wire.

In fact, the pcap recording on the backend node actually revealed that the node with the XDP LB was leaking uninitialized kernel data onto the wire for the affected packets, for example, while the packets should have been 152 bytes their actual size was 1482 bytes, so the remainder after 152 bytes was padded with whatever other data was in that page at the time (e.g. we saw user/payload data from prior processed packets).

We only noticed this through an MTU issue, e.g. when the XDP LB node and the backend node both had the same MTU (e.g. 1500) then the curl request got dropped on the backend node's NIC given the packet was too large even though the IPIP-encapped packet normally would never even come close to the MTU limit. Lowering the MTU on the XDP LB (e.g. 1480) allowed to let the curl request succeed (which also indicates that the kernel ignored the padding, and thus the issue wasn't very user-visible).

Commit e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") was too eager to also switch xdp_prepare_buff() from rcd->len to rbi->len. It really needs to stick to rcd->len which is the actual packet length from the descriptor. The latter we also feed into vmxnet3_process_xdp_small(), by the way, and it indicates the correct length needed to initialize the xdp->{data,data_end} parts. For e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") the relevant part was adapting xdp_init_buff() to address the warning given the xdp_data_hard_end() depends on xdp->frame_sz. With that fixed, traffic on the wire looks good again.(CVE-2025-37799)

In the Linux kernel, the following vulnerability has been resolved:

usb: chipidea: ci_hdrc_imx: fix usbmisc handling

usbmisc is an optional device property so it is totally valid for the corresponding data->usbmisc_data to have a NULL value.

Check that before dereferencing the pointer.

Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.(CVE-2025-37811)

In the Linux kernel, the following vulnerability has been resolved:

sfc: fix NULL dereferences in ef100_process_design_param()

Since cited commit, ef100_probe_main() and hence also ef100_check_design_params() run before efx->net_dev is created; consequently, we cannot netif_set_tso_max_size() or _segs() at this point. Move those netif calls to ef100_probe_netdev(), and also replace netif_err within the design params code with pci_err.(CVE-2025-37860)

Severity

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-21916	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-21950	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-23144	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-37742	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-37755	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-37799	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-37811	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-37860	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "bpftool-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "bpftool-debuginfo-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "kernel-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "kernel-debuginfo-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "kernel-debugsource-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "kernel-devel-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "kernel-headers-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "kernel-source-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "kernel-tools-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "kernel-tools-debuginfo-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "kernel-tools-devel-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "perf-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "perf-debuginfo-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "python3-perf-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm",
          "python3-perf-debuginfo-6.6.0-90.0.0.95.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "kernel-6.6.0-90.0.0.95.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "bpftool-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "bpftool-debuginfo-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "kernel-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "kernel-debuginfo-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "kernel-debugsource-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "kernel-devel-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "kernel-headers-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "kernel-source-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "kernel-tools-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "kernel-tools-debuginfo-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "kernel-tools-devel-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "perf-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "perf-debuginfo-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "python3-perf-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm",
          "python3-perf-debuginfo-6.6.0-90.0.0.95.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.6.0-90.0.0.95.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: cxacru: fix a flaw in existing endpoint checks\n\nSyzbot once again identified a flaw in usb endpoint checking, see [1].\nThis time the issue stems from a commit authored by me (2eabb655a968\n(\u0026quot;usb: atm: cxacru: fix endpoint checking in cxacru_bind()\u0026quot;)).\n\nWhile using usb_find_common_endpoints() may usually be enough to\ndiscard devices with wrong endpoints, in this case one needs more\nthan just finding and identifying the sufficient number of endpoints\nof correct types - one needs to check the endpoint\u0026apos;s address as well.\n\nSince cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind,\nswitch the endpoint verification approach to usb_check_XXX_endpoints()\ninstead to fix incomplete ep testing.\n\n[1] Syzbot report:\nusb 5-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503\n...\nRIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503\n...\nCall Trace:\n \u0026lt;TASK\u0026gt;\n cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649\n cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline]\n cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223\n usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058\n cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377\n usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396\n really_probe+0x2b9/0xad0 drivers/base/dd.c:658\n __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800\n driver_probe_device+0x50/0x430 drivers/base/dd.c:830\n...(CVE-2025-21916)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl\n\nIn the \u0026quot;pmcmd_ioctl\u0026quot; function, three memory objects allocated by\nkmalloc are initialized by \u0026quot;hcall_get_cpu_state\u0026quot;, which are then\ncopied to user space. The initializer is indeed implemented in\n\u0026quot;acrn_hypercall2\u0026quot; (arch/x86/include/asm/acrn.h). There is a risk of\ninformation leakage due to uninitialized bytes.(CVE-2025-21950)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbacklight: led_bl: Hold led_access lock when calling led_sysfs_disable()\n\nLockdep detects the following issue on led-backlight removal:\n  [  142.315935] ------------[ cut here ]------------\n  [  142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80\n  ...\n  [  142.500725] Call trace:\n  [  142.503176]  led_sysfs_enable+0x54/0x80 (P)\n  [  142.507370]  led_bl_remove+0x80/0xa8 [led_bl]\n  [  142.511742]  platform_remove+0x30/0x58\n  [  142.515501]  device_remove+0x54/0x90\n  ...\n\nIndeed, led_sysfs_enable() has to be called with the led_access\nlock held.\n\nHold the lock when calling led_sysfs_disable().(CVE-2025-23144)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uninit-value access of imap allocated in the diMount() function\n\nsyzbot reports that hex_dump_to_buffer is using uninit-value:\n\n=====================================================\nBUG: KMSAN: uninit-value in hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171\nhex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171\nprint_hex_dump+0x13d/0x3e0 lib/hexdump.c:276\ndiFree+0x5ba/0x4350 fs/jfs/jfs_imap.c:876\njfs_evict_inode+0x510/0x550 fs/jfs/inode.c:156\nevict+0x723/0xd10 fs/inode.c:796\niput_final fs/inode.c:1946 [inline]\niput+0x97b/0xdb0 fs/inode.c:1972\ntxUpdateMap+0xf3e/0x1150 fs/jfs/jfs_txnmgr.c:2367\ntxLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]\njfs_lazycommit+0x627/0x11d0 fs/jfs/jfs_txnmgr.c:2733\nkthread+0x6b9/0xef0 kernel/kthread.c:464\nret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:148\nret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nUninit was created at:\nslab_post_alloc_hook mm/slub.c:4121 [inline]\nslab_alloc_node mm/slub.c:4164 [inline]\n__kmalloc_cache_noprof+0x8e3/0xdf0 mm/slub.c:4320\nkmalloc_noprof include/linux/slab.h:901 [inline]\ndiMount+0x61/0x7f0 fs/jfs/jfs_imap.c:105\njfs_mount+0xa8e/0x11d0 fs/jfs/jfs_mount.c:176\njfs_fill_super+0xa47/0x17c0 fs/jfs/super.c:523\nget_tree_bdev_flags+0x6ec/0x910 fs/super.c:1636\nget_tree_bdev+0x37/0x50 fs/super.c:1659\njfs_get_tree+0x34/0x40 fs/jfs/super.c:635\nvfs_get_tree+0xb1/0x5a0 fs/super.c:1814\ndo_new_mount+0x71f/0x15e0 fs/namespace.c:3560\npath_mount+0x742/0x1f10 fs/namespace.c:3887\ndo_mount fs/namespace.c:3900 [inline]\n__do_sys_mount fs/namespace.c:4111 [inline]\n__se_sys_mount+0x71f/0x800 fs/namespace.c:4088\n__x64_sys_mount+0xe4/0x150 fs/namespace.c:4088\nx64_sys_call+0x39bf/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:166\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\n=====================================================\n\nThe reason is that imap is not properly initialized after memory\nallocation. It will cause the snprintf() function to write uninitialized\ndata into linebuf within hex_dump_to_buffer().\n\nFix this by using kzalloc instead of kmalloc to clear its content at the\nbeginning in diMount().(CVE-2025-37742)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: handle page_pool_dev_alloc_pages error\n\npage_pool_dev_alloc_pages could return NULL. There was a WARN_ON(!page)\nbut it would still proceed to use the NULL pointer and then crash.\n\nThis is similar to commit 001ba0902046\n(\u0026quot;net: fec: handle page_pool_dev_alloc_pages error\u0026quot;).\n\nThis is found by our static analysis tool KNighter.(CVE-2025-37755)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp\n\nvmxnet3 driver\u0026apos;s XDP handling is buggy for packet sizes using ring0 (that\nis, packet sizes between 128 - 3k bytes).\n\nWe noticed MTU-related connectivity issues with Cilium\u0026apos;s service load-\nbalancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP\nbackend service where the XDP LB was doing IPIP encap led to overly large\npacket sizes but only for *some* of the packets (e.g. HTTP GET request)\nwhile others (e.g. the prior TCP 3WHS) looked completely fine on the wire.\n\nIn fact, the pcap recording on the backend node actually revealed that the\nnode with the XDP LB was leaking uninitialized kernel data onto the wire\nfor the affected packets, for example, while the packets should have been\n152 bytes their actual size was 1482 bytes, so the remainder after 152 bytes\nwas padded with whatever other data was in that page at the time (e.g. we\nsaw user/payload data from prior processed packets).\n\nWe only noticed this through an MTU issue, e.g. when the XDP LB node and\nthe backend node both had the same MTU (e.g. 1500) then the curl request\ngot dropped on the backend node\u0026apos;s NIC given the packet was too large even\nthough the IPIP-encapped packet normally would never even come close to\nthe MTU limit. Lowering the MTU on the XDP LB (e.g. 1480) allowed to let\nthe curl request succeed (which also indicates that the kernel ignored the\npadding, and thus the issue wasn\u0026apos;t very user-visible).\n\nCommit e127ce7699c1 (\u0026quot;vmxnet3: Fix missing reserved tailroom\u0026quot;) was too eager\nto also switch xdp_prepare_buff() from rcd-\u0026gt;len to rbi-\u0026gt;len. It really needs\nto stick to rcd-\u0026gt;len which is the actual packet length from the descriptor.\nThe latter we also feed into vmxnet3_process_xdp_small(), by the way, and\nit indicates the correct length needed to initialize the xdp-\u0026gt;{data,data_end}\nparts. For e127ce7699c1 (\u0026quot;vmxnet3: Fix missing reserved tailroom\u0026quot;) the\nrelevant part was adapting xdp_init_buff() to address the warning given the\nxdp_data_hard_end() depends on xdp-\u0026gt;frame_sz. With that fixed, traffic on\nthe wire looks good again.(CVE-2025-37799)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: ci_hdrc_imx: fix usbmisc handling\n\nusbmisc is an optional device property so it is totally valid for the\ncorresponding data-\u0026gt;usbmisc_data to have a NULL value.\n\nCheck that before dereferencing the pointer.\n\nFound by Linux Verification Center (linuxtesting.org) with Svace static\nanalysis tool.(CVE-2025-37811)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix NULL dereferences in ef100_process_design_param()\n\nSince cited commit, ef100_probe_main() and hence also\n ef100_check_design_params() run before efx-\u0026gt;net_dev is created;\n consequently, we cannot netif_set_tso_max_size() or _segs() at this\n point.\nMove those netif calls to ef100_probe_netdev(), and also replace\n netif_err within the design params code with pci_err.(CVE-2025-37860)",
  "id": "OESA-2025-1512",
  "modified": "2026-08-06T11:08:36Z",
  "published": "2025-05-16T11:08:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1512"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21916"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21950"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23144"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37742"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37755"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37799"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37811"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37860"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2025-21916",
    "CVE-2025-21950",
    "CVE-2025-23144",
    "CVE-2025-37742",
    "CVE-2025-37755",
    "CVE-2025-37799",
    "CVE-2025-37811",
    "CVE-2025-37860"
  ]
}

SUSE-SU-2025:01614-1

Vulnerability from csaf_suse - Published: 2025-05-21 09:52 - Updated: 2025-05-21 09:52

Summary

Security update for the Linux Kernel

Severity

Important

Scope

170 vulnerabilities in this advisory, including CVE-2025-21916.

CVE-2025-21916

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 174 products

Open the full advisory

SUSE-SU-2025:01707-1

Vulnerability from csaf_suse - Published: 2025-05-26 11:35 - Updated: 2025-05-26 11:35

Summary

Security update for the Linux Kernel

Severity

Important

Scope

170 vulnerabilities in this advisory, including CVE-2025-21916.

CVE-2025-21916

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 33 products

Open the full advisory

SUSE-SU-2025:01919-1

Vulnerability from csaf_suse - Published: 2025-06-12 06:29 - Updated: 2025-06-12 06:29

Summary

Security update for the Linux Kernel

Severity

Important

Scope

433 vulnerabilities in this advisory, including CVE-2025-21916.

CVE-2025-21916

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2025:01951-1

Vulnerability from csaf_suse - Published: 2025-06-13 13:54 - Updated: 2025-06-13 13:54

Summary

Security update for the Linux Kernel

Severity

Important

Scope

321 vulnerabilities in this advisory, including CVE-2025-21916.

CVE-2025-21916

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 56 products

Open the full advisory

SUSE-SU-2025:01964-1

Vulnerability from csaf_suse - Published: 2025-06-16 14:54 - Updated: 2025-06-16 14:54

Summary

Security update for the Linux Kernel

Severity

Important

Scope

339 vulnerabilities in this advisory, including CVE-2025-21916.

CVE-2025-21916

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 30 products

Open the full advisory

SUSE-SU-2025:01967-1

Vulnerability from csaf_suse - Published: 2025-06-16 14:56 - Updated: 2025-06-16 14:56

Summary

Security update for the Linux Kernel

Severity

Important

Scope

329 vulnerabilities in this advisory, including CVE-2025-21916.

CVE-2025-21916

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2025:1293-1

Vulnerability from csaf_suse - Published: 2025-04-16 07:51 - Updated: 2025-04-16 07:51

Summary

Security update for the Linux Kernel

Severity

Important

Scope

222 vulnerabilities in this advisory, including CVE-2025-21916.

CVE-2025-21916

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 56 products

Open the full advisory

SUSE-SU-2025:20192-1

Vulnerability from csaf_suse - Published: 2025-04-17 14:37 - Updated: 2025-04-17 14:37

Summary

Security update for the Linux Kernel

Severity

Important

Scope

347 vulnerabilities in this advisory, including CVE-2025-21916.

CVE-2025-21916

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 13 products

Open the full advisory

SUSE-SU-2025:20206-1

Vulnerability from csaf_suse - Published: 2025-04-25 09:37 - Updated: 2025-04-25 09:37

Summary

Security update for the Linux Kernel

Severity

Important

Scope

75 vulnerabilities in this advisory, including CVE-2025-21916.

CVE-2025-21916

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 5 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-21916 (GCVE-0-2025-21916)

Vulnerability from osv_openeuler

Tags

Sightings

Nomenclature

Related by attack behaviour