[SRU][N][PATCH 0/1] CVE-2025-21687

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-21687

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

vfio/platform: check the bounds of read/write syscalls

count and offset are passed from user space and not checked, only offset is
capped to 40 bits, which can be used to read/write out of bounds of the device.

[ Fix ]

noble/linux: clean cherry-pick of ce9ff21ea89d

The fix adds explicit bounds checking so that the combination of the
user-supplied count and offset must fall within the size of the targeted
device region before any read or write is performed.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

This change only affects the vfio/platform driver, which is used to assign
platform devices to userspace or virtual machines. A bad fix could reject
legitimate read/write accesses to a device region and break users who pass
through platform devices via VFIO, for example on ARM/embedded systems that
rely on vfio-platform for device assignment. Systems that do not use
vfio-platform, including the common PCI passthrough path (vfio-pci), are
not affected.

[ Other Info ]

Kybele flow-v11-21-g0f091652. Reference: 9870e982/v1