Critical Out-of-Bounds Access Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-21650: In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue The TQP BAR space is divided into two segments. Affects linux versions < 6.12.10-1. Fixed in 6.12.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the hns3 driver, which manages network interfaces.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the hns3 driver, specifically in the hclge_fetch_pf_reg function. This function fails to properly distinguish between different segments of the TQP BAR space, leading to potential out-of-bounds access when the number of TQPs exceeds 1024. This can result in kernel paging requests being mishandled, causing system instability and crashes. The error message indicates that the system is unable to handle a kernel paging request at a specific virtual address, which can lead to severe consequences, including denial of service.
How To Fix
Minimum fixed version
6.12.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround is provided for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The identified vulnerability in the Linux kernel's hns3 driver poses significant risks to system stability and security. Users are strongly advised to update their kernel to the patched version 6.12.10-1 to protect against potential exploits. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds access issue in the hns3 driver of the Linux kernel, which can lead to system crashes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
The vulnerability can cause kernel crashes, leading to system instability and potential denial of service.
Yes, the patched version of the Linux kernel is 6.12.10-1 for both Debian 13 and 14.
While no specific workaround is available, it is crucial to prioritize updating your kernel to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
