CVE-2025-21742

In the Linux kernel, the following vulnerability has been resolved:

usbnet: ipheth: use static NDP16 location in URB

Original code allowed for the start of NDP16 to be anywhere within the URB based on the wNdpIndex value in NTH16. Only the start position of NDP16 was checked, so it was possible for even the fixed-length part of NDP16 to extend past the end of URB, leading to an out-of-bounds read.

On iOS devices, the NDP16 header always directly follows NTH16. Rely on and check for this specific format.

This, along with NCM-specific minimal URB length check that already exists, will ensure that the fixed-length part of NDP16 plus a set amount of DPEs fit within the URB.

Note that this commit alone does not fully address the OoB read. The limit on the amount of DPEs needs to be enforced separately.

This vulnerability is rated as Moderate severity because exploitation requires local access and the attachment of a malicious USB device, limiting the attack surface to scenarios where physical or virtualized hardware can be introduced. In typical enterprise server environments, the Apple iPhone USB Ethernet driver is not utilized, meaning default deployments are not exposed under normal operations. A local attacker able to provide or emulate an iPhone USB connection could trigger an out-of-bounds read, resulting in a denial of service (system crash) or unauthorized reading of kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.