CVE-2025-21687: vfio/platform: check the bounds of read/write syscalls
Vulnerability summary
CVE-2025-21687 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.5% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 37 · Related 33Timeline
- 10-02-2025PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of read/write syscalls count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.24% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu139 products
- linuxAll versions (No fix recorded) | < 5.4.0-211.231 | < 5.15.0-135.146 | < 6.8.0-147.147
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.4.0-1142.152 | < 5.15.0-1080.87 | < 6.8.0-1067.70
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < f21636f24b6786c8b13f1af4319fa75ffcf17f38 | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < 9377cdc118cf327248f1a9dde7b87de067681dc9 | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < d19a8650fd3d7aed8d1af1d9a77f979a8430eba1 | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < ed81d82bb6e9df3a137f2c343ed689e6c68268ef | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < 92340e6c5122d823ad064984ef7513eba9204048 | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < f65ce06387f8c1fb54bd59e18a8428248ec68eaf | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < 6bcb8a5b70b80143db9bf12dfa7d53636f824d53 | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < 1485932496a1b025235af8aa1e21988d6b7ccd54 | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < c981c32c38af80737a2fedc16e270546d139ccdd | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < a20fcaa230f7472456d12cf761ed13938e320ac3 | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < 665cfd1083866f87301bbd232cb8ba48dcf4acce | ≥ 6e3f264560099869f68830cb14b3b3e71e5ac76a, < ce9ff21ea89d191e477a02ad7eabf4f996b80a69 | 4.1
- linux_kernelEOL≥ 4.1, < 5.4.290 | ≥ 5.5, < 5.10.234 | ≥ 5.11, < 5.15.178 | ≥ 5.16, < 6.1.128 | ≥ 6.2, < 6.6.75 | ≥ 6.7, < 6.12.12 | 6.13 | 6.13:rc1 | 6.13:rc2 | 6.13:rc3 | 6.13:rc4 | 6.13:rc5 | 6.13:rc6 | 6.13:rc7
Debian1 product
- linux< 6.1.128-1 | < 6.12.12-1
3 vendors · 142 products
