CVE-2025-21993: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-21993 Overview

CVE-2025-21993 is a Linux kernel vulnerability in the iscsi_ibft (iSCSI Boot Firmware Table) subsystem. The flaw resides in the ibft_attr_show_nic() function and triggers a UBSAN (Undefined Behavior Sanitizer) shift-out-of-bounds warning during iSCSI boot operations over IPv6. When iscsistart reads the /sys/firmware/ibft/ethernetX/subnet-mask sysfs entry with an IPv6 prefix length of 64, the shift exponent becomes negative, producing undefined behavior. The issue is classified under [CWE-125] (Out-of-Bounds Read) and affects Linux kernel builds up to and including 6.14-rc1.

Critical Impact
A local low-privileged user can trigger undefined behavior in the kernel by reading the iBFT sysfs interface during IPv6 iSCSI boot, potentially resulting in kernel information disclosure or system instability affecting availability.

Affected Products

Linux Kernel (multiple stable branches prior to the fix)
Linux Kernel 6.14-rc1
Debian LTS distributions shipping affected kernel packages

Discovery Timeline

2025-04-02 - CVE-2025-21993 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21993

Vulnerability Analysis

The vulnerability exists in the ibft_attr_show_nic() function within the iscsi_ibft kernel driver. This driver exposes iSCSI Boot Firmware Table entries via the sysfs interface at /sys/firmware/ibft/. During an iSCSI boot session, the iscsistart userspace utility reads these entries to configure network parameters.

When the boot session uses IPv6, iscsistart still queries the subnet-mask attribute even though subnet masks are an IPv4-only concept. The kernel computes the subnet mask by performing a bit shift operation based on the prefix length. For IPv6 prefixes of 64 bits, the calculation produces a negative shift exponent, which is undefined behavior in C and triggers a UBSAN warning.

The fix sets the returned value to ~0 when the operation would otherwise cause an invalid shift, suppressing the warning and returning a deterministic value.

Root Cause

The root cause is missing input validation on the prefix length before performing an arithmetic shift operation. The original code assumed IPv4 semantics where prefix lengths never exceed 32, but did not defensively handle IPv6 prefix values passed through the shared code path. This maps to [CWE-125] because the undefined shift can lead to reading memory outside expected bounds during subsequent operations.

Attack Vector

Exploitation requires local access with low privileges. An attacker with the ability to read the /sys/firmware/ibft/ethernetX/subnet-mask sysfs entry on a system configured for IPv6 iSCSI boot can trigger the undefined shift. The vulnerability is not remotely exploitable and requires no user interaction beyond the sysfs read. Because iBFT is populated by platform firmware at boot, exploitation depends on the target being provisioned for iSCSI boot with IPv6.

The vulnerability mechanism is documented in the upstream kernel commits. See the kernel.org stable commit b388e185 for the reference patch.

Detection Methods for CVE-2025-21993

Indicators of Compromise

UBSAN warning messages in dmesg or the kernel ring buffer referencing ibft_attr_show_nic and shift-out-of-bounds behavior
Unexpected kernel oopses or stack traces on systems configured for IPv6 iSCSI boot
Repeated reads of /sys/firmware/ibft/ethernetX/subnet-mask from unprivileged processes

Detection Strategies

Query the running kernel version with uname -r and compare against fixed stable branches published on kernel.org
Enable UBSAN in kernel builds where feasible and monitor kernel logs for shift-out-of-bounds reports originating in drivers/firmware/iscsi_ibft.c
Inventory hosts that have iscsi_ibft module loaded via lsmod | grep iscsi_ibft and cross-reference against IPv6 boot configurations

Monitoring Recommendations

Centralize dmesg and /var/log/kern.log output for kernel warning correlation across the fleet
Alert on process reads of iBFT sysfs paths by non-root or non-iscsi processes
Track kernel patch levels of iSCSI-booted systems as a distinct asset class in vulnerability management tooling

How to Mitigate CVE-2025-21993

Immediate Actions Required

Apply the latest stable kernel updates from your Linux distribution vendor that include the upstream fix
Prioritize patching on systems that perform iSCSI boot with IPv6, as these are directly exposed to the code path
Review Debian LTS advisories including DLA msg00030 and DLA msg00045 for backported package versions

Patch Information

The fix was merged into multiple Linux stable branches. Reference commits include b388e185, 07e0d99a, 2d1eef24, 9bfa80c8, a858cd58, b253660f, c1c6e527, and f763c82d. Consult your distribution's advisory for the specific package version containing the backport.

Workarounds

Restrict read access to /sys/firmware/ibft/ where operationally feasible to limit exposure to unprivileged local users
Unload the iscsi_ibft module on systems that do not require iSCSI boot using modprobe -r iscsi_ibft
Where IPv6 iSCSI boot is not required, reconfigure the target to boot via IPv4 to avoid the vulnerable code path

bash

# Verify kernel version and iBFT module state
uname -r
lsmod | grep iscsi_ibft

# Optional: unload iBFT module if not required for boot
sudo modprobe -r iscsi_ibft

# Optional: restrict sysfs read permissions on the iBFT entries
sudo chmod 0400 /sys/firmware/ibft/ethernet*/subnet-mask