CVE-2025-21873scsi: ufs: core: bsg: Fix crash when arpmb command fails
- 5.5MediumCVSS base score
- 0.23%Exploitation in 30 daysEPSS · top 86% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: bsg: Fix crash when arpmb command fails If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io_fn(). In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not set the job's reply_len. Memory crash backtrace: 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22 4,1308,531166555,-;Call Trace: 4,1309,531166559,-; <TASK> 4,1310,531166565,-; ? show_regs+0x6d/0x80 4,1311,531166575,-; ? die+0x37/0xa0 4,1312,531166583,-; ? do_trap+0xd4/0xf0 4,1313,531166593,-; ? do_error_trap+0x71/0xb0 4,1314,531166601,-; ? usercopy_abort+0x6c/0x80 4,1315,531166610,-; ? exc_invalid_op+0x52/0x80 4,1316,531166622,-; ? usercopy_abort+0x6c/0x80 4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20 4,1318,531166643,-; ? usercopy_abort+0x6c/0x80 4,1319,531166652,-; __check_heap_object+0xe3/0x120 4,1320,531166661,-; check_heap_object+0x185/0x1d0 4,1321,531166670,-; __check_object_size.part.0+0x72/0x150 4,1322,531166679,-; __check_object_size+0x23/0x30 4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0
Timeline
ID reserved
By Linux
- 3 months later
· 3 months later
Published
- 14 months later
· 14 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.23% · top 86% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 6ff265fc5ef660499e0edc4641647e99eed3f519 – < 32fb5ec825f6f76bc28902181c65429a904a07fe
- affected 6ff265fc5ef660499e0edc4641647e99eed3f519 – < 59455f968c1004ed897ba873237657745d81ce0f
- affected 6ff265fc5ef660499e0edc4641647e99eed3f519 – < 7e3c96ff5c5f3206984ed077b2aa8c9b7c4e0327
- affected 6ff265fc5ef660499e0edc4641647e99eed3f519 – < f27a95845b01e86d67c8b014b4f41bd3327daa63
- affected 6.3
- unaffected < 6.3
- unaffected 6.6.81 – ≤ 6.6.*
- unaffected 6.12.18 – ≤ 6.12.*
- unaffected 6.13.6 – ≤ 6.13.*
- unaffected 6.14 – ≤ *
References
References4
- https://git.kernel.org/stable/c/32fb5ec825f6f76bc28902181c65429a904a07fe (opens in a new tab)
- https://git.kernel.org/stable/c/59455f968c1004ed897ba873237657745d81ce0f (opens in a new tab)
- https://git.kernel.org/stable/c/7e3c96ff5c5f3206984ed077b2aa8c9b7c4e0327 (opens in a new tab)
- https://git.kernel.org/stable/c/f27a95845b01e86d67c8b014b4f41bd3327daa63 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-8491 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-21873)Record last updated .