CVE-2025-21734

misc: fastrpc: Fix copy buffer page size

HIGH

7.8

CVSS Score

Published: February 27, 2025 at 02:12 AM UTC

Updated: August 5, 2026 at 12:44 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix copy buffer page size For non-registered buffer, fastrpc driver copies the buffer and pass it to the remote subsystem. There is a problem with current implementation of page size calculation which is not considering the offset in the calculation. This might lead to passing of improper and out-of-bounds page size which could result in memory issue. Calculate page start and page end using the offset adjusted address instead of absolute address.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.2 ≤ v < 6.1.1295.2 ≤ v < 6.12.145.2 ≤ v < 6.13.35.2 ≤ v < 6.145.2 ≤ v < 6.6.786.13 ≤ v < 6.13.36.2 ≤ v < 6.6.786.7 ≤ v < 6.12.142b45b47fbe84e23699bb6bdc74d4c2780e282b45.2

Vendor states this is fixed in 24a79c6bc8de763f7c50f4f84f8b0c183bc25a51 (fixed)

Vendor states this is fixed in c0464bad0e85fcd5d47e4297d1e410097c979e55 (fixed)

Vendor states this is fixed in c3f7161123fcbdc64e90119ccce292d8b66281c4 (fixed)

Vendor states this is fixed in c56ba3ea8e3c9a69a992aad18f7a65e43e51d623 (fixed)

Vendor states this is fixed in e966eae72762ecfdbdb82627e2cda48845b9dd66 (fixed)

Vendor states this is fixed in 5.2 (unaffected)

Vendor states this is fixed in 6.1.129 (unaffected)

Vendor states this is fixed in 6.12.14 (unaffected)

Vendor states this is fixed in 6.13.3 (unaffected)

Vendor states this is fixed in 6.14 (unaffected)

Vendor states this is fixed in 6.6.78 (unaffected)