{"vulnerability": "cve-2025-2191", "sightings": [{"uuid": "fa05a997-3572-4b26-81b7-4699bb96e404", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2191", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lk4af5yobl26", "content": "", "creation_timestamp": "2025-03-11T14:05:54.898304Z"}, {"uuid": "3c63c4f0-7f77-411e-a7ca-3e714b49258e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2025-21912", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8", "content": "", "creation_timestamp": "2025-12-03T14:14:49.267740Z"}, {"uuid": "2feff5d3-6103-46c2-bd2e-5f68941a4b91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-21915", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "703958a3-58ff-4479-bc9b-b7a5973a5d8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-21918", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "9732a722-004e-4d83-bb38-c3996e91aeaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2191", "type": "seen", "source": "https://t.me/cvedetector/20085", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-2191 - Claro A7600-A1 RNR4-A72T Ping6 Diagn\u00f3stico Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-2191 \nPublished : March 11, 2025, 12:15 p.m. | 1\u00a0hour, 58\u00a0minutes ago \nDescription : A vulnerability, which was classified as problematic, has been found in Claro A7600-A1 RNR4-A72T-2x16_v2110403_CLA_32_160817. Affected by this issue is some unknown functionality of the file /form2pingv6.cgi of the component Ping6 Diagn\u00f3stico. The manipulation of the argument ip6addr with the input  leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. \nSeverity: 2.4 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"11 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-11T15:57:16.000000Z"}, {"uuid": "1a136c98-e3e4-42f5-baa5-df9f22abe915", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-21915", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10053", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-21915\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: In the Linux kernel, the following vulnerability has been resolved:\n\ncdx: Fix possible UAF error in driver_override_show()\n\nFixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c\n\nThis function driver_override_show() is part of DEVICE_ATTR_RW, which\nincludes both driver_override_show() and driver_override_store().\nThese functions can be executed concurrently in sysfs.\n\nThe driver_override_store() function uses driver_set_override() to\nupdate the driver_override value, and driver_set_override() internally\nlocks the device (device_lock(dev)). If driver_override_show() reads\ncdx_dev->driver_override without locking, it could potentially access\na freed pointer if driver_override_store() frees the string\nconcurrently. This could lead to printing a kernel address, which is a\nsecurity risk since DEVICE_ATTR can be read by all users.\n\nAdditionally, a similar pattern is used in drivers/amba/bus.c, as well\nas many other bus drivers, where device_lock() is taken in the show\nfunction, and it has been working without issues.\n\nThis potential bug was detected by our experimental static analysis\ntool, which analyzes locking APIs and paired functions to identify\ndata races and atomicity violations.\n\ud83d\udccf Published: 2025-04-01T15:40:52.019Z\n\ud83d\udccf Modified: 2025-04-02T12:16:54.498Z\n\ud83d\udd17 References:\n1. https://git.kernel.org/stable/c/d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf\n2. https://git.kernel.org/stable/c/8473135f89c0949436a22adb05b8cece2fb3da91\n3. https://git.kernel.org/stable/c/0439d541aa8d3444ad41c39e39eb71acb57acde3\n4. https://git.kernel.org/stable/c/91d44c1afc61a2fec37a9c7a3485368309391e0b", "creation_timestamp": "2025-04-02T12:36:42.000000Z"}, {"uuid": "c551df64-6bb8-41c7-8349-e862072b722f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-21918", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10681", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-21918\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Fix NULL pointer access\n\nResources should be released only after all threads that utilize them\nhave been destroyed.\nThis commit ensures that resources are not released prematurely by waiting\nfor the associated workqueue to complete before deallocating them.\n\ud83d\udccf Published: 2025-04-01T15:40:53.561Z\n\ud83d\udccf Modified: 2025-04-07T08:36:57.272Z\n\ud83d\udd17 References:\n1. https://git.kernel.org/stable/c/7a735a8a46f6ebf898bbefd96659ca5da798bce0\n2. https://git.kernel.org/stable/c/46fba7be161bb89068958138ea64ec33c0b446d4\n3. https://git.kernel.org/stable/c/079a3e52f3e751bb8f5937195bdf25c5d14fdff0\n4. https://git.kernel.org/stable/c/592a0327d026a122e97e8e8bb7c60cbbe7697344\n5. https://git.kernel.org/stable/c/b13abcb7ddd8d38de769486db5bd917537b32ab1", "creation_timestamp": "2025-04-07T08:44:49.000000Z"}, {"uuid": "b48cfb66-8e9d-4b8f-9032-7d22fed004bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-21913", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:17:49.321931Z"}, {"uuid": "d2a93ef3-e94e-4a14-ab8d-71257243322e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-21919", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04", "content": "", "creation_timestamp": "2026-07-28T16:17:51.985569Z"}, {"uuid": "eec97a24-3f3d-42de-9ca5-8d24baa82560", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-21913", "type": "seen", "source": "https://infosec.exchange/users/andersonc0d3/statuses/117202687407493983", "content": "RE: https://infosec.exchange/@andersonc0d3/117197828727921773\nThe exception table mechanism in the page fault handler is popular, but maybe the mechanism in the general protection handler isn't so well-known.\nWhen the code is interacting with MSRs, if the MSR index/address is invalid for the architecture, it triggers a #GP and the kernel oopses. This can happen in some scenarios and most of the cases it shouldn't trigger an oops and crash the kernel. That's why there are two MSR access implementations: rdmsr() / rdmsrq() and rdmsr_safe() / rdmsrq_safe(). The rdmsr variants use split 32-bit values for high/low bits, while rdmsrq handles 64-bit quadwords directly.\nThere is a proposal to retire legacy 32-bit user-space MSR interfaces, but I haven't followed this closely.\nLinux Preparing To Retire Its 32-bit MSR Interfaceshttps://www.phoronix.com/news/Linux-Ending-32-bit-MSR-Work\nThe safe ones are supposed to not crash/oops the kernel when the #GP is issued. It implements the same exception table mechanism present in the page fault handler. That's why it contains *_safe() in the function name.\nThis is checked by the general protection fault handler via fixup_exception() at line below:\nhttps://github.com/torvalds/linux/blob/master/arch/x86/kernel/traps.c#L949\nThere was an oops caused by the use of rdmsrl() when running the Linux kernel as a Xen guest and the fix was to replace rdmsrl() with rdmsrl_safe().\nCVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()https://lore.kernel.org/linux-cve-announce/2025040130-CVE-2025-21913-b942@gregkh/T\nx86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=14cb5d83068ecf15d2da6f7d0e9ea9edbcbc0457\nThe interface was rdmsrl before being renamed to rdmsrq.\nIn the case of virtualization, things get more complicated because the hypervisor might have different configurations. That issue in the Linux kernel seems to have been exposed due to a change in Xen regarding MSRs accesses.\nxen/pv: support selecting safe/unsafe msr accesses https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3fac3734c43a2e21fefeb72124d8bd31dff3956f", "creation_timestamp": "2026-09-02T17:44:45.393030Z"}]}