{"id":"CVE-2025-21738","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-sff: Ensure that we cannot write outside the allocated buffer\n\nreveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len\nset to 0xd42, SCSI …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-sff: Ensure that we cannot write outside the allocated buffer\n\nreveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len\nset to 0xd42, SCSI …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel < 6.1.129","linux_kernel >= 6.2, < 6.6.78","linux_kernel >= 6.7, < 6.12.14","linux_kernel >= 6.13, < 6.13.3"],"patched":["linux_kernel 6.13.3"],"published":"2025-02-27","updated":"2026-07-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-21738","references":[{"url":"https://git.kernel.org/stable/c/0a17a9944b8d89ef03946121241870ac53ddaf45","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0dd5aade301a10f4b329fa7454fdcc2518741902","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e74e53b34b6dec5a50e1404e2680852ec6768d2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5e6e3000309359eae2a17117aa6e3c44897bf6c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00224,"epssPercentile":0.1337,"ingestedAt":"2026-07-30T06:53:09.596Z","slug":"CVE-2025-21738","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-sff: Ensure that we cannot write outside the allocated buffer\n\nreveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len\nset to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to\nATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to\nwrite outside the allocated buffer, overwriting random memory.\n\nWhile a ATA device is supposed to abort a ATA_NOP command, there does seem\nto be a bug either in libata-sff or QEMU, where either this status is not\nset, or the status is cleared before read by ata_sff_hsm_move().\nAnyway, that is most likely a separate bug.\n\nLooking at __atapi_pio_bytes(), it already has a safety check to ensure\nthat __atapi_pio_bytes() cannot write outside the allocated buffer.\n\nAdd a similar check to ata_pio_sector(), such that also ata_pio_sector()\ncannot write outside the allocated buffer.\n\n## Affected\n\n- `linux_kernel < 6.1.129`\n- `linux_kernel >= 6.2, < 6.6.78`\n- `linux_kernel >= 6.7, < 6.12.14`\n- `linux_kernel >= 6.13, < 6.13.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.13.3`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}