CVE-2025-21735

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: Add bounds checking in nci_hci_create_pipe()

The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
LinuxLinux>= a1b0b9415817c14d207921582f269d03f848b69f, < bd249109d266f1d52548c46634a15b71656e0d44; >= a1b0b9415817c14d207921582f269d03f848b69f, < 674e17c5933779a8bf5c15d596fdfcb5ccdebbc2; >= a1b0b9415817c14d207921582f269d03f848b69f, < 10b3f947b609713e04022101f492d288a014ddfa; >= a1b0b9415817c14d207921582f269d03f848b69f, < d5a461c315e5ff92657f84d8ba50caa5abf5c22a; >= a1b0b9415817c14d207921582f269d03f848b69f, < 172cdfc3a5ea20289c58fb73dadc6fd4a8784a4e; >= a1b0b9415817c14d207921582f269d03f848b69f, < 2ae4bade5a64d126bd18eb66bd419005c5550218; >= a1b0b9415817c14d207921582f269d03f848b69f, < 59c7ed20217c0939862fbf8145bc49d5b3a13f4f; >= a1b0b9415817c14d207921582f269d03f848b69f, < 110b43ef05342d5a11284cc8b21582b698b4ef1c
LinuxLinux4.4
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *

References

Timeline

Published
Feb 27, 2025
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-217365.5In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix possible int overflows in nilfs_fiemap() Since nilfs_bmap_CVE-2025-217375.5In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_mds_auth_match() We now free the temporaCVE-2025-217385.5In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffCVE-2025-217397.8In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix use-after free in init error and remove paths devCVE-2025-21747.5A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_sCVE-2025-217417.1In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix DPE OoB read Fix an out-of-bounds DPE read, limit CVE-2025-217427.1In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: use static NDP16 location in URB Original code allowedCVE-2025-217437.1In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix possible overflow in DPE length check Originally, CVE-2025-217445.5In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() On CVE-2025-217455.5In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage blkcg_CVE-2025-217464.7In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabCVE-2025-217475.5In the Linux kernel, the following vulnerability has been resolved: drm/ast: astdp: Fix timeout for enabling video signal The ASTDP transm
CVE-2025-21735: High severity, CVSS 7.8 | Vulnix