CVE-2025-21873
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-21873
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21873.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-21873
- Downstream
- Related
- Published
- 2025-03-27T14:57:04Z
- Modified
- 2025-10-22T10:03:48.142383Z
- Summary
- scsi: ufs: core: bsg: Fix crash when arpmb command fails
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: bsg: Fix crash when arpmb command fails
If the device doesn't support arpmb we'll crash due to copying user data in bsgtransportsgiofn().
In the case where ufsbsgexecadvancedrpmbreq() returns an error, do not set the job's replylen.
Memory crash backtrace: 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22
4,1308,531166555,-;Call Trace:
4,1309,531166559,-; <TASK>
4,1310,531166565,-; ? show_regs+0x6d/0x80
4,1311,531166575,-; ? die+0x37/0xa0
4,1312,531166583,-; ? do_trap+0xd4/0xf0
4,1313,531166593,-; ? doerrortrap+0x71/0xb0
4,1314,531166601,-; ? usercopy_abort+0x6c/0x80
4,1315,531166610,-; ? excinvalidop+0x52/0x80
4,1316,531166622,-; ? usercopy_abort+0x6c/0x80
4,1317,531166630,-; ? asmexcinvalid_op+0x1b/0x20
4,1318,531166643,-; ? usercopy_abort+0x6c/0x80
4,1319,531166652,-; _checkheap_object+0xe3/0x120
4,1320,531166661,-; checkheapobject+0x185/0x1d0
4,1321,531166670,-; _checkobject_size.part.0+0x72/0x150
4,1322,531166679,-; _checkobject_size+0x23/0x30
4,1323,531166688,-; bsgtransportsgiofn+0x314/0x3b0
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/32fb5ec825f6f76bc28902181c65429a904a07fe
- https://git.kernel.org/stable/c/59455f968c1004ed897ba873237657745d81ce0f
- https://git.kernel.org/stable/c/7e3c96ff5c5f3206984ed077b2aa8c9b7c4e0327
- https://git.kernel.org/stable/c/f27a95845b01e86d67c8b014b4f41bd3327daa63
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6ff265fc5ef660499e0edc4641647e99eed3f519Fixed32fb5ec825f6f76bc28902181c65429a904a07fe
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6ff265fc5ef660499e0edc4641647e99eed3f519Fixed59455f968c1004ed897ba873237657745d81ce0f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6ff265fc5ef660499e0edc4641647e99eed3f519Fixed7e3c96ff5c5f3206984ed077b2aa8c9b7c4e0327
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6ff265fc5ef660499e0edc4641647e99eed3f519Fixedf27a95845b01e86d67c8b014b4f41bd3327daa63