vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-21713

powerpc/pseries/iommu: Don't unset window if it was never set

MEDIUM
5.5
CVSS Score
Published: February 27, 2025 at 02:07 AM UTC
Updated: June 17, 2026 at 08:44 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when user attempts to use the same vfio container used by different iommu group, the spapr_tce_set_window() returns -EPERM and the subsequent cleanup leads to the below crash. Kernel attempted to read user page (308) - exploit attempt? BUG: Kernel NULL pointer dereference on read at 0x00000308 Faulting instruction address: 0xc0000000001ce358 Oops: Kernel access of bad area, sig: 11 [#1] NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0 <snip> NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510 LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510 Call Trace: spapr_tce_unset_window+0xbc/0x510 (unreliable) tce_iommu_attach_group+0x24c/0x340 [vfio_iommu_spapr_tce] vfio_container_attach_group+0xec/0x240 [vfio] vfio_group_fops_unl_ioctl+0x548/0xb00 [vfio] sys_ioctl+0x754/0x1580 system_call_exception+0x13c/0x330 system_call_vectored_common+0x15c/0x2ec <snip> --- interrupt: 3000 Fix this by having null check for the tbl passed to the spapr_tce_unset_window().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
6.11 ≤ v < 6.12.136.11 ≤ v < 6.13.26.11 ≤ v < 6.146.13 ≤ v < 6.13.26.11f431a8cde7f102fce412546db6e62fdbde1131a7
Vendor states this is fixed in 17391cb2613b82f8c405570fea605af3255ff8d2 (fixed)
Vendor states this is fixed in ac12372a13dab3f7a2762db240bd180de8ef1e5e (fixed)
Vendor states this is fixed in b853ff0b514c1df314246fcf94744005914b48cb (fixed)
Vendor states this is fixed in 6.11 (unaffected)
Vendor states this is fixed in 6.12.13 (unaffected)
Vendor states this is fixed in 6.13.2 (unaffected)
Vendor states this is fixed in 6.14 (unaffected)

References (3)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/17391cb2613b82f8c405570fea605af3255ff8d2
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ac12372a13dab3f7a2762db240bd180de8ef1e5e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b853ff0b514c1df314246fcf94744005914b48cb

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUMCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card