CVE-2025-21741

In the Linux kernel, the following vulnerability has been resolved:

usbnet: ipheth: fix DPE OoB read

Fix an out-of-bounds DPE read, limit the number of processed DPEs to the amount that fits into the fixed-size NDP16 header.

This vulnerability is rated Moderate rather than Important because exploitation requires physical access to attach a malicious USB device, or the ability to attach emulated USB peripherals in virtualized guest environments. In typical Red Hat Enterprise Linux environments, mobile device USB tethering is rarely utilized, significantly limiting exposure in standard deployments. When a malformed packet header is processed by the Apple iPhone USB Ethernet (ipheth) driver, an out-of-bounds read occurs, which can allow an attacker to cause a system crash resulting in a denial of service or potentially disclose kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.