CVE-2025-21772

In the Linux kernel, the following vulnerability has been resolved:

partitions: mac: fix handling of bogus partition table

Fix several issues in partition probing:

• The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded.
• If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory.
• We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp().

This vulnerability is evaluated with a Moderate severity impact because triggering the issue requires presenting a maliciously crafted storage medium to the kernel's partition probing subsystem. While a successful exploit can trigger an out-of-bounds memory read resulting in a kernel crash or potential leakage of kernel memory, it is bounded by the prerequisite of local physical access or privileges to attach block devices. Under typical Red Hat Enterprise Linux server deployments, block devices from untrusted sources are not automatically attached or mounted, significantly reducing the practical attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.