CVE-2025-21772: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-21772 Overview

CVE-2025-21772 is an out-of-bounds write vulnerability [CWE-787] in the Linux kernel's Mac partition table probing code. The flaw resides in block/partitions/mac.c, which mishandles malformed or bogus partition tables during device probing. Specifically, the code fails to validate absurd sector sizes, does not release device sector references correctly on error paths, and assumes NUL-terminated strings inside partition table entries. An attacker with local access who can present a crafted block device or disk image can trigger out-of-bounds memory access during partition parsing. The vulnerability affects multiple Linux kernel branches, including the 6.14 release candidates.

Critical Impact
Local attackers can trigger memory corruption in kernel space by inserting a malicious storage device or image, potentially resulting in privilege escalation, denial of service, or kernel information disclosure.

Affected Products

Linux kernel stable branches prior to the fix commits
Linux kernel 6.14-rc1
Linux kernel 6.14-rc2

Discovery Timeline

2025-02-27 - CVE-2025-21772 published to NVD
2025-03 - Debian LTS security advisory issued
2025-05 - Additional Debian LTS advisory issued
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-21772

Vulnerability Analysis

The vulnerability exists in the Mac partition table parser inside the Linux kernel block subsystem. The parser performs three unsafe operations when handling malformed partition tables. First, on the error path for a bad partoffset value, the code fails to call put_dev_sector() after a successful read_part_sector(), leaving a leaked reference to the sector buffer. Second, the parser trusts the partition table's declared sector size without sanity checking. A crafted value such as 0xfff bytes creates entries that straddle sector boundaries, causing the code to read and write memory outside allocated buffers. Third, the parser uses strlen() and strcmp() on partition name fields without assuming they may lack NUL termination, allowing reads beyond the intended field length.

Root Cause

The root cause is insufficient input validation of attacker-controlled data structures read from a block device. The Mac partition parser treats on-disk metadata as trusted, applying arithmetic and string operations without bounds enforcement. The combination of unchecked sector size arithmetic and unbounded string handling enables an out-of-bounds write in kernel memory.

Attack Vector

Exploitation requires local access with the ability to introduce a block device or disk image to the target system. Common scenarios include plugging in a USB storage device containing a crafted Mac partition table, mounting a malicious loopback image, or attaching a virtual disk in a hypervisor environment where the guest can influence block layout. When the kernel automatically probes the device partitions, the malformed table triggers the out-of-bounds write in kernel space. The vulnerability requires low privileges and no user interaction beyond device attachment.

No public proof-of-concept exploit is available at this time. The fixes are distributed across multiple upstream stable commits, including 213ba5bd81b7, 27a39d006f85, 40a35d14f3c0, 6578717ebca9, 7fa970672288, 80e648042e51, 92527100be38, and a3e77da9f843.

Detection Methods for CVE-2025-21772

Indicators of Compromise

Kernel oops or panic messages referencing mac_partition, read_part_sector, or generic out-of-bounds access in the block partition subsystem
Unexpected block device probing events immediately following USB or removable media insertion
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds access in block/partitions/mac.c on instrumented kernels

Detection Strategies

Enable KASAN or similar kernel memory safety instrumentation on test systems to catch out-of-bounds writes during partition probing
Audit installed kernel versions against the fixed commit hashes published on git.kernel.org to identify unpatched hosts
Monitor dmesg and journalctl -k output for partition parser warnings correlated with removable media events

Monitoring Recommendations

Log and alert on udev block device add events from untrusted USB ports on multi-user systems
Correlate kernel crash reports with recent storage device attachment through centralized logging
Track kernel package versions across the fleet and flag hosts running vulnerable versions of the 6.x series and earlier LTS branches

How to Mitigate CVE-2025-21772

Immediate Actions Required

Apply the latest stable kernel update from your distribution vendor that includes the referenced upstream fix commits
Prioritize patching multi-user systems, kiosks, and hosts with exposed USB ports where local device attachment is plausible
Review Siemens Security Advisory SSA-265688 if operating affected Siemens industrial products that ship the Linux kernel

Patch Information

The fix is upstream in the Linux kernel and backported to multiple stable branches. Reference the commits 213ba5bd81b7, 27a39d006f85, 40a35d14f3c0, 6578717ebca9, 7fa970672288, 80e648042e51, 92527100be38, and a3e77da9f843 on git.kernel.org. Distribution updates are available through the Debian LTS Announcement March 2025 and Debian LTS Announcement May 2025. Siemens customers should consult the Siemens Security Advisory SSA-265688.

Workarounds

Disable automatic partition probing for removable media where feasible by configuring udev rules to ignore untrusted block devices
Restrict physical access to USB and storage interfaces on shared systems until patches are applied
Blacklist the mac_partition support in kernels where Apple partition tables are not required by rebuilding without CONFIG_MAC_PARTITION if the operational environment permits

bash

# Verify running kernel version and check against patched releases
uname -r
apt list --installed 2>/dev/null | grep linux-image

# Example udev rule to prevent automatic probing of untrusted USB block devices
# Save to /etc/udev/rules.d/99-block-untrusted-usb.rules
ACTION=="add", SUBSYSTEM=="block", ENV{ID_BUS}=="usb", ENV{UDISKS_IGNORE}="1"