CVE-2025-21993

iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()

Description

In the Linux kernel, the following vulnerability has been resolved: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message.

Category

7.1
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.02%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/a858cd58dea06cf85b142673deea8c5d87f11e70 patch
https://git.kernel.org/stable/c/f763c82db8166e28f45b7cc4a5398a7859665940 patch
https://git.kernel.org/stable/c/b388e185bfad32bfed6a97a6817f74ca00a4318f patch
https://git.kernel.org/stable/c/9bfa80c8aa4e06dff55a953c3fffbfc68a3a3b1c patch
https://git.kernel.org/stable/c/2d1eef248107bdf3d5a69d0fde04c30a79a7bf5d patch
https://git.kernel.org/stable/c/b253660fac5e0e9080d2c95e3a029e1898d49afb patch
https://git.kernel.org/stable/c/c1c6e527470e5eab0b2d57bd073530fbace39eab patch
https://git.kernel.org/stable/c/07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 patch

Frequently Asked Questions

What is the severity of CVE-2025-21993?
CVE-2025-21993 has been scored as a high severity vulnerability.
How to fix CVE-2025-21993?
To fix CVE-2025-21993, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-21993 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-21993 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-21993?
CVE-2025-21993 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.