5.5

CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails

Analyzed
AliasesUBUNTU-CVE-2025-21873DEBIAN-CVE-2025-21873
Published 27-03-2025Last modified 11-05-2026

Vulnerability summary

CVE-2025-21873 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.21%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 27
SUSE-SU-2025:01614-1SUSE-SU-2025:01707-1SUSE-SU-2025:01919-1SUSE-SU-2025:01951-1SUSE-SU-2025:01964-1SUSE-SU-2025:01967-1

Timeline

  1. 27-03-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: bsg: Fix crash when arpmb command fails If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io_fn(). In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not set the job's reply_len. Memory crash backtrace: 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22 4,1308,531166555,-;Call Trace: 4,1309,531166559,-; <TASK> 4,1310,531166565,-; ? show_regs+0x6d/0x80 4,1311,531166575,-; ? die+0x37/0xa0 4,1312,531166583,-; ? do_trap+0xd4/0xf0 4,1313,531166593,-; ? do_error_trap+0x71/0xb0 4,1314,531166601,-; ? usercopy_abort+0x6c/0x80 4,1315,531166610,-; ? exc_invalid_op+0x52/0x80 4,1316,531166622,-; ? usercopy_abort+0x6c/0x80 4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20 4,1318,531166643,-; ? usercopy_abort+0x6c/0x80 4,1319,531166652,-; __check_heap_object+0xe3/0x120 4,1320,531166661,-; check_heap_object+0x185/0x1d0 4,1321,531166670,-; __check_object_size.part.0+0x72/0x150 4,1322,531166679,-; __check_object_size+0x23/0x30 4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.20% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu110 products
  • linux< 6.8.0-84.84
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.8.0-1039.41
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 6ff265fc5ef660499e0edc4641647e99eed3f519, < 32fb5ec825f6f76bc28902181c65429a904a07fe | ≥ 6ff265fc5ef660499e0edc4641647e99eed3f519, < 59455f968c1004ed897ba873237657745d81ce0f | ≥ 6ff265fc5ef660499e0edc4641647e99eed3f519, < 7e3c96ff5c5f3206984ed077b2aa8c9b7c4e0327 | ≥ 6ff265fc5ef660499e0edc4641647e99eed3f519, < f27a95845b01e86d67c8b014b4f41bd3327daa63 | 6.3
  • linux_kernel≥ 6.3, < 6.6.81 | ≥ 6.7, < 6.12.18 | ≥ 6.13, < 6.13.6 | 6.14:rc1 | 6.14:rc2 | 6.14:rc3 | 6.14:rc4
Debian1 product
  • linux< 6.12.19-1

3 vendors · 113 products

References

25 links
Show all 25 references