Critical Vulnerability in Linux Kernel: PowerPC pSeries IOMMU NULL Pointer Dereference
Summary
DEBIAN-CVE-2025-21713: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when user attempts to use the same vfio container used by different iommu grou... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is highly modular and supports a wide range of architectures, including PowerPC. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the PowerPC pSeries architecture, where improper handling of IOMMU operations can lead to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the PowerPC pSeries IOMMU subsystem. When a user attempts to use the same VFIO container across different IOMMU groups, the function spapr_tce_set_window() returns an error (-EPERM). This leads to a subsequent cleanup process that can cause a NULL pointer dereference, resulting in a kernel crash. The error manifests as a kernel access of a bad area, potentially indicating an exploit attempt. The crash can lead to system instability and data loss, making it critical to address this issue promptly.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The identified vulnerability in the Linux kernel related to the PowerPC pSeries IOMMU subsystem poses significant risks, including system crashes and instability. It is crucial for users of Debian 13 and 14 to update to the patched version 6.12.13-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a NULL pointer dereference in the PowerPC pSeries IOMMU subsystem of the Linux kernel, which can lead to system crashes.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.12.13-1.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities in real-time without requiring installation.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Exploitation of this vulnerability can lead to kernel crashes, system instability, and potential data loss, making it essential to address it promptly.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
