« Volver al listado

CVE-2025-68760

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show

In iommu_mmio_write(), it validates the user-provided offset with the check: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`. This assumes a 4-byte access. However, the corresponding show handler, iommu_mmio_show(), uses readq() to perform an 8-byte (64-bit) read.

If a user provides an offset equal to `mmio_phys_end - 4`, the check passes, and will lead to a 4-byte out-of-bounds read.

Fix this by adjusting the boundary check to use sizeof(u64), which corresponds to the size of the readq() operation.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68760",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7a4ee419e8c144b747a8915856e91a034d7c8f34",
              "lessThan": "b959df804c33913dbfdb90750f2d693502b3d126",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7a4ee419e8c144b747a8915856e91a034d7c8f34",
              "lessThan": "0ec4aaf5f3f559716a6559f3d6d9616e9470bed6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7a4ee419e8c144b747a8915856e91a034d7c8f34",
              "lessThan": "a0c7005333f9a968abb058b1d77bbcd7fb7fd1e7",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/iommu/amd/debugfs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/iommu/amd/debugfs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-01-05T10:15:57.123",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0ec4aaf5f3f559716a6559f3d6d9616e9470bed6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a0c7005333f9a968abb058b1d77bbcd7fb7fd1e7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b959df804c33913dbfdb90750f2d693502b3d126",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix potential out-of-bounds read in iommu_mmio_show\n\nIn iommu_mmio_write(), it validates the user-provided offset with the\ncheck: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`.\nThis assumes a 4-byte access. However, the corresponding\nshow handler, iommu_mmio_show(), uses readq() to perform an 8-byte\n(64-bit) read.\n\nIf a user provides an offset equal to `mmio_phys_end - 4`, the check\npasses, and will lead to a 4-byte out-of-bounds read.\n\nFix this by adjusting the boundary check to use sizeof(u64), which\ncorresponds to the size of the readq() operation."
    }
  ],
  "lastModified": "2026-06-17T09:59:32.580",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}