vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-21690

scsi: storvsc: Ratelimit warning logs to prevent VM denial of service

MEDIUM
5.5
CVSS Score
Published: February 10, 2025 at 03:58 PM UTC
Updated: June 17, 2026 at 08:44 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persistent error in the hypervisor, the SCSI warning for failed I/O can flood the kernel log and max out CPU utilization, preventing troubleshooting from the VM side. Ratelimit the warning so it doesn't DoS the VM.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
v < 5.15.1784.5 ≤ v < 5.15.1784.5 ≤ v < 6.1.1284.5 ≤ v < 6.12.124.5 ≤ v < 6.13.14.5 ≤ v < 6.144.5 ≤ v < 6.6.755.16 ≤ v < 6.1.1286.2 ≤ v < 6.6.756.7 ≤ v < 6.12.126.136.13 rc16.13 rc26.13 rc36.13 rc46.13 rc56.13 rc66.13 rc7f8aea701b77c26732f151aab4f0a70e62eb53d86
Vendor states this is fixed in 01d1ebdab9ccb73c952e1666a8a80abd194dbc55 (fixed)
Vendor states this is fixed in 088bde862f8d3d0fc52e40e66a0484a246837087 (fixed)
Vendor states this is fixed in 182a4b7c731e95c08cb47f14b87a272b6ab2b2da (fixed)
Vendor states this is fixed in 81d4dd05c412ba04f9f6b85b718e6da833be290c (fixed)
Vendor states this is fixed in d0f0af1bafef33b3e2aa8c3a4ef44db48df9b0ea (fixed)
Vendor states this is fixed in d2138eab8cde61e0e6f62d0713e45202e8457d6d (fixed)
Vendor states this is fixed in 4.5 (unaffected)
Vendor states this is fixed in 5.15.178 (unaffected)
Vendor states this is fixed in 6.1.128 (unaffected)
Vendor states this is fixed in 6.12.12 (unaffected)
Vendor states this is fixed in 6.13.1 (unaffected)
Vendor states this is fixed in 6.14 (unaffected)
Vendor states this is fixed in 6.6.75 (unaffected)

References (7)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/01d1ebdab9ccb73c952e1666a8a80abd194dbc55
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/088bde862f8d3d0fc52e40e66a0484a246837087
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/182a4b7c731e95c08cb47f14b87a272b6ab2b2da
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/81d4dd05c412ba04f9f6b85b718e6da833be290c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d0f0af1bafef33b3e2aa8c3a4ef44db48df9b0ea
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d2138eab8cde61e0e6f62d0713e45202e8457d6d
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUMCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-770

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card