CVE-2025-21687

In the Linux kernel, the following vulnerability has been resolved:

vfio/platform: check the bounds of read/write syscalls

count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device.

This vulnerability is rated with a Moderate severity because exploitation requires local system access with privileges to interact with VFIO platform device nodes. In standard Red Hat deployments, access to VFIO device interfaces is restricted to administrative users or dedicated virtualization processes, and platform device passthrough is rarely utilized compared to PCI passthrough. Consequently, unprivileged users cannot trigger this flaw without prior administrative delegation of the underlying platform device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.