CVE-2025-21663 (GCVE-0-2025-21663)

Vulnerability from cvelistv5 – Published: 2025-01-21 12:18 – Updated: 2026-08-05 11:53
VLAI
Title
net: stmmac: dwmac-tegra: Read iommu stream id from device tree
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree Nvidia's Tegra MGBE controllers require the IOMMU "Stream ID" (SID) to be written to the MGBE_WRAP_AXI_ASID0_CTRL register. The current driver is hard coded to use MGBE0's SID for all controllers. This causes softirq time outs and kernel panics when using controllers other than MGBE0. Example dmesg errors when an ethernet cable is connected to MGBE1: [ 116.133290] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [ 121.851283] tegra-mgbe 6910000.ethernet eth1: NETDEV WATCHDOG: CPU: 5: transmit queue 0 timed out 5690 ms [ 121.851782] tegra-mgbe 6910000.ethernet eth1: Reset adapter. [ 121.892464] tegra-mgbe 6910000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-0 [ 121.905920] tegra-mgbe 6910000.ethernet eth1: PHY [stmmac-1:00] driver [Aquantia AQR113] (irq=171) [ 121.907356] tegra-mgbe 6910000.ethernet eth1: Enabling Safety Features [ 121.907578] tegra-mgbe 6910000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported [ 121.908399] tegra-mgbe 6910000.ethernet eth1: registered PTP clock [ 121.908582] tegra-mgbe 6910000.ethernet eth1: configuring for phy/10gbase-r link mode [ 125.961292] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [ 181.921198] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 181.921404] rcu: 7-....: (1 GPs behind) idle=540c/1/0x4000000000000002 softirq=1748/1749 fqs=2337 [ 181.921684] rcu: (detected by 4, t=6002 jiffies, g=1357, q=1254 ncpus=8) [ 181.921878] Sending NMI from CPU 4 to CPUs 7: [ 181.921886] NMI backtrace for cpu 7 [ 181.922131] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: loaded Not tainted 6.13.0-rc3+ #6 [ 181.922390] Hardware name: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 10/28/2024 [ 181.922658] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 181.922847] pc : handle_softirqs+0x98/0x368 [ 181.922978] lr : __do_softirq+0x18/0x20 [ 181.923095] sp : ffff80008003bf50 [ 181.923189] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000 [ 181.923379] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0 [ 181.924486] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70 [ 181.925568] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000 [ 181.926655] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000 [ 181.931455] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d [ 181.938628] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160 [ 181.945804] x8 : ffff8000827b3160 x7 : f9157b241586f343 x6 : eeb6502a01c81c74 [ 181.953068] x5 : a4acfcdd2e8096bb x4 : ffffce78ea277340 x3 : 00000000ffffd1e1 [ 181.960329] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000 [ 181.967591] Call trace: [ 181.970043] handle_softirqs+0x98/0x368 (P) [ 181.974240] __do_softirq+0x18/0x20 [ 181.977743] ____do_softirq+0x14/0x28 [ 181.981415] call_on_irq_stack+0x24/0x30 [ 181.985180] do_softirq_own_stack+0x20/0x30 [ 181.989379] __irq_exit_rcu+0x114/0x140 [ 181.993142] irq_exit_rcu+0x14/0x28 [ 181.996816] el1_interrupt+0x44/0xb8 [ 182.000316] el1h_64_irq_handler+0x14/0x20 [ 182.004343] el1h_64_irq+0x80/0x88 [ 182.007755] cpuidle_enter_state+0xc4/0x4a8 (P) [ 182.012305] cpuidle_enter+0x3c/0x58 [ 182.015980] cpuidle_idle_call+0x128/0x1c0 [ 182.020005] do_idle+0xe0/0xf0 [ 182.023155] cpu_startup_entry+0x3c/0x48 [ 182.026917] secondary_start_kernel+0xdc/0x120 [ 182.031379] __secondary_switched+0x74/0x78 [ 212.971162] rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 7-.... } 6103 jiffies s: 417 root: 0x80/. [ 212.985935] rcu: blocking rcu_node structures (internal RCU debug): [ 212.992758] Sending NMI from CPU 0 to CPUs 7: [ 212.998539] NMI backtrace for cpu 7 [ 213.004304] CPU: 7 UID: 0 PI ---truncated---
Severity
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d8ca113724e79b324f553914cefa9dd6961de152 , < 235419f0956e8c60e597aa1619ded8bda7460bb4 (git)
Affected: d8ca113724e79b324f553914cefa9dd6961de152 , < b04d33cdbc958a3fd57f3544d4f78b99d9d11909 (git)
Affected: d8ca113724e79b324f553914cefa9dd6961de152 , < 426046e2d62dd19533808661e912b8e8a9eaec16 (git)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.72 , ≤ 6.6.* (semver)
Unaffected: 6.12.10 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "235419f0956e8c60e597aa1619ded8bda7460bb4",
              "status": "affected",
              "version": "d8ca113724e79b324f553914cefa9dd6961de152",
              "versionType": "git"
            },
            {
              "lessThan": "b04d33cdbc958a3fd57f3544d4f78b99d9d11909",
              "status": "affected",
              "version": "d8ca113724e79b324f553914cefa9dd6961de152",
              "versionType": "git"
            },
            {
              "lessThan": "426046e2d62dd19533808661e912b8e8a9eaec16",
              "status": "affected",
              "version": "d8ca113724e79b324f553914cefa9dd6961de152",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: dwmac-tegra: Read iommu stream id from device tree\n\nNvidia\u0027s Tegra MGBE controllers require the IOMMU \"Stream ID\" (SID) to be\nwritten to the MGBE_WRAP_AXI_ASID0_CTRL register.\n\nThe current driver is hard coded to use MGBE0\u0027s SID for all controllers.\nThis causes softirq time outs and kernel panics when using controllers\nother than MGBE0.\n\nExample dmesg errors when an ethernet cable is connected to MGBE1:\n\n[  116.133290] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx\n[  121.851283] tegra-mgbe 6910000.ethernet eth1: NETDEV WATCHDOG: CPU: 5: transmit queue 0 timed out 5690 ms\n[  121.851782] tegra-mgbe 6910000.ethernet eth1: Reset adapter.\n[  121.892464] tegra-mgbe 6910000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-0\n[  121.905920] tegra-mgbe 6910000.ethernet eth1: PHY [stmmac-1:00] driver [Aquantia AQR113] (irq=171)\n[  121.907356] tegra-mgbe 6910000.ethernet eth1: Enabling Safety Features\n[  121.907578] tegra-mgbe 6910000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported\n[  121.908399] tegra-mgbe 6910000.ethernet eth1: registered PTP clock\n[  121.908582] tegra-mgbe 6910000.ethernet eth1: configuring for phy/10gbase-r link mode\n[  125.961292] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx\n[  181.921198] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\n[  181.921404] rcu: \t7-....: (1 GPs behind) idle=540c/1/0x4000000000000002 softirq=1748/1749 fqs=2337\n[  181.921684] rcu: \t(detected by 4, t=6002 jiffies, g=1357, q=1254 ncpus=8)\n[  181.921878] Sending NMI from CPU 4 to CPUs 7:\n[  181.921886] NMI backtrace for cpu 7\n[  181.922131] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: loaded Not tainted 6.13.0-rc3+ #6\n[  181.922390] Hardware name: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 10/28/2024\n[  181.922658] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  181.922847] pc : handle_softirqs+0x98/0x368\n[  181.922978] lr : __do_softirq+0x18/0x20\n[  181.923095] sp : ffff80008003bf50\n[  181.923189] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000\n[  181.923379] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0\n[  181.924486] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70\n[  181.925568] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000\n[  181.926655] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000\n[  181.931455] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d\n[  181.938628] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160\n[  181.945804] x8 : ffff8000827b3160 x7 : f9157b241586f343 x6 : eeb6502a01c81c74\n[  181.953068] x5 : a4acfcdd2e8096bb x4 : ffffce78ea277340 x3 : 00000000ffffd1e1\n[  181.960329] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000\n[  181.967591] Call trace:\n[  181.970043]  handle_softirqs+0x98/0x368 (P)\n[  181.974240]  __do_softirq+0x18/0x20\n[  181.977743]  ____do_softirq+0x14/0x28\n[  181.981415]  call_on_irq_stack+0x24/0x30\n[  181.985180]  do_softirq_own_stack+0x20/0x30\n[  181.989379]  __irq_exit_rcu+0x114/0x140\n[  181.993142]  irq_exit_rcu+0x14/0x28\n[  181.996816]  el1_interrupt+0x44/0xb8\n[  182.000316]  el1h_64_irq_handler+0x14/0x20\n[  182.004343]  el1h_64_irq+0x80/0x88\n[  182.007755]  cpuidle_enter_state+0xc4/0x4a8 (P)\n[  182.012305]  cpuidle_enter+0x3c/0x58\n[  182.015980]  cpuidle_idle_call+0x128/0x1c0\n[  182.020005]  do_idle+0xe0/0xf0\n[  182.023155]  cpu_startup_entry+0x3c/0x48\n[  182.026917]  secondary_start_kernel+0xdc/0x120\n[  182.031379]  __secondary_switched+0x74/0x78\n[  212.971162] rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 7-.... } 6103 jiffies s: 417 root: 0x80/.\n[  212.985935] rcu: blocking rcu_node structures (internal RCU debug):\n[  212.992758] Sending NMI from CPU 0 to CPUs 7:\n[  212.998539] NMI backtrace for cpu 7\n[  213.004304] CPU: 7 UID: 0 PI\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The mis-tagged DMA path is the MGBE controller\u0027s RX/TX engine, exercised by frames received from the network; an unauthenticated remote host sending IP traffic routed to the affected interface drives descriptor fetches and buffer writes that carry the wrong Stream ID. Per net-driver receive-path convention this is Network.\nAC:L - The wrong SID is written unconditionally at probe and resume on every non-MGBE0 controller, so the condition is permanent from boot with no race, timing window, or memory-layout requirement outside the attacker\u0027s control. Any traffic on the interface reliably reaches the affected DMA path.\nPR:N - No authentication or account on the target is needed \u2014 merely delivering Ethernet/IP frames to the affected NIC exercises the RX DMA path, and the resulting watchdog/reset/RCU-stall condition occurs without any local privilege.\nUI:N - No victim action is required; link-up and ordinary inbound traffic are sufficient, and the misconfiguration is already in place before any user does anything.\nS:C - The SMMU Stream ID is the security authority enforcing per-device DMA confinement, and emitting MGBE0\u0027s SID makes MGBE1/2/3 DMA escape their assigned IOMMU domain \u2014 translated by another device\u0027s page tables, or untranslated against raw physical addresses when bypass is permitted. This is an IOMMU/DMA isolation boundary crossing, not a same-authority failure.\nC:H - With the wrong stream, MGBE1\u0027s TX engine fetches descriptors and payload from MGBE0\u0027s IOMMU domain \u2014 kernel skb pages and ring contents belonging to a different interface \u2014 and transmits them onto the attacker\u0027s network segment, disclosing another device\u0027s DMA-mapped memory.\nI:H - MGBE1\u0027s RX engine writes attacker-controlled frame contents and descriptor writebacks into MGBE0\u0027s mapped buffers and rings, corrupting another device\u0027s DMA memory and injecting data into an unrelated interface\u0027s receive path; where bypass is permitted the writes land at unchecked physical addresses.\nA:H - The commit documents NETDEV WATCHDOG transmit-queue timeouts, an endless \"Reset adapter\" loop, rcu_preempt CPU stalls, and outright kernel panics on affected hardware \u2014 a persistent, unrecoverable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:27.976Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/235419f0956e8c60e597aa1619ded8bda7460bb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b04d33cdbc958a3fd57f3544d4f78b99d9d11909"
        },
        {
          "url": "https://git.kernel.org/stable/c/426046e2d62dd19533808661e912b8e8a9eaec16"
        }
      ],
      "title": "net: stmmac: dwmac-tegra: Read iommu stream id from device tree",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21663",
    "datePublished": "2025-01-21T12:18:18.347Z",
    "dateReserved": "2024-12-29T08:45:45.732Z",
    "dateUpdated": "2026-08-05T11:53:27.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21663",
      "date": "2026-08-06",
      "epss": "0.00407",
      "percentile": "0.33461"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21663\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-21T13:15:09.947\",\"lastModified\":\"2026-07-30T06:18:04.917\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: stmmac: dwmac-tegra: Read iommu stream id from device tree\\n\\nNvidia\u0027s Tegra MGBE controllers require the IOMMU \\\"Stream ID\\\" (SID) to be\\nwritten to the MGBE_WRAP_AXI_ASID0_CTRL register.\\n\\nThe current driver is hard coded to use MGBE0\u0027s SID for all controllers.\\nThis causes softirq time outs and kernel panics when using controllers\\nother than MGBE0.\\n\\nExample dmesg errors when an ethernet cable is connected to MGBE1:\\n\\n[  116.133290] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx\\n[  121.851283] tegra-mgbe 6910000.ethernet eth1: NETDEV WATCHDOG: CPU: 5: transmit queue 0 timed out 5690 ms\\n[  121.851782] tegra-mgbe 6910000.ethernet eth1: Reset adapter.\\n[  121.892464] tegra-mgbe 6910000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-0\\n[  121.905920] tegra-mgbe 6910000.ethernet eth1: PHY [stmmac-1:00] driver [Aquantia AQR113] (irq=171)\\n[  121.907356] tegra-mgbe 6910000.ethernet eth1: Enabling Safety Features\\n[  121.907578] tegra-mgbe 6910000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported\\n[  121.908399] tegra-mgbe 6910000.ethernet eth1: registered PTP clock\\n[  121.908582] tegra-mgbe 6910000.ethernet eth1: configuring for phy/10gbase-r link mode\\n[  125.961292] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx\\n[  181.921198] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\\n[  181.921404] rcu: \\t7-....: (1 GPs behind) idle=540c/1/0x4000000000000002 softirq=1748/1749 fqs=2337\\n[  181.921684] rcu: \\t(detected by 4, t=6002 jiffies, g=1357, q=1254 ncpus=8)\\n[  181.921878] Sending NMI from CPU 4 to CPUs 7:\\n[  181.921886] NMI backtrace for cpu 7\\n[  181.922131] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: loaded Not tainted 6.13.0-rc3+ #6\\n[  181.922390] Hardware name: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 10/28/2024\\n[  181.922658] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n[  181.922847] pc : handle_softirqs+0x98/0x368\\n[  181.922978] lr : __do_softirq+0x18/0x20\\n[  181.923095] sp : ffff80008003bf50\\n[  181.923189] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000\\n[  181.923379] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0\\n[  181.924486] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70\\n[  181.925568] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000\\n[  181.926655] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000\\n[  181.931455] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d\\n[  181.938628] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160\\n[  181.945804] x8 : ffff8000827b3160 x7 : f9157b241586f343 x6 : eeb6502a01c81c74\\n[  181.953068] x5 : a4acfcdd2e8096bb x4 : ffffce78ea277340 x3 : 00000000ffffd1e1\\n[  181.960329] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000\\n[  181.967591] Call trace:\\n[  181.970043]  handle_softirqs+0x98/0x368 (P)\\n[  181.974240]  __do_softirq+0x18/0x20\\n[  181.977743]  ____do_softirq+0x14/0x28\\n[  181.981415]  call_on_irq_stack+0x24/0x30\\n[  181.985180]  do_softirq_own_stack+0x20/0x30\\n[  181.989379]  __irq_exit_rcu+0x114/0x140\\n[  181.993142]  irq_exit_rcu+0x14/0x28\\n[  181.996816]  el1_interrupt+0x44/0xb8\\n[  182.000316]  el1h_64_irq_handler+0x14/0x20\\n[  182.004343]  el1h_64_irq+0x80/0x88\\n[  182.007755]  cpuidle_enter_state+0xc4/0x4a8 (P)\\n[  182.012305]  cpuidle_enter+0x3c/0x58\\n[  182.015980]  cpuidle_idle_call+0x128/0x1c0\\n[  182.020005]  do_idle+0xe0/0xf0\\n[  182.023155]  cpu_startup_entry+0x3c/0x48\\n[  182.026917]  secondary_start_kernel+0xdc/0x120\\n[  182.031379]  __secondary_switched+0x74/0x78\\n[  212.971162] rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 7-.... } 6103 jiffies s: 417 root: 0x80/.\\n[  212.985935] rcu: blocking rcu_node structures (internal RCU debug):\\n[  212.992758] Sending NMI from CPU 0 to CPUs 7:\\n[  212.998539] NMI backtrace for cpu 7\\n[  213.004304] CPU: 7 UID: 0 PI\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: stmmac: dwmac-tegra: Leer el ID de flujo de iommu del \u00e1rbol de dispositivos Los controladores Tegra MGBE de Nvidia requieren que el \\\"ID de flujo\\\" (SID) de IOMMU se escriba en el registro MGBE_WRAP_AXI_ASID0_CTRL. El controlador actual est\u00e1 codificado de forma r\u00edgida para utilizar el SID de MGBE0 para todos los controladores. Esto provoca tiempos de espera de softirq y p\u00e1nicos del kernel cuando se utilizan controladores distintos de MGBE0. Ejemplo de errores dmesg cuando un cable Ethernet est\u00e1 conectado a MGBE1: [ 116.133290] tegra-mgbe 6910000.ethernet eth1: El enlace est\u00e1 activo - 1 Gbps/completo - control de flujo rx/tx [ 121.851283] tegra-mgbe 6910000.ethernet eth1: NETDEV WATCHDOG: CPU: 5: la cola de transmisi\u00f3n 0 agot\u00f3 el tiempo de espera de 5690 ms [ 121.851782] tegra-mgbe 6910000.ethernet eth1: Reiniciar el adaptador. [ 121.892464] tegra-mgbe 6910000.ethernet eth1: Registrar MEM_TYPE_PAGE_POOL RxQ-0 [ 121.905920] tegra-mgbe 6910000.ethernet eth1: Controlador PHY [stmmac-1:00] [Aquantia AQR113] (irq=171) [ 121.907356] tegra-mgbe 6910000.ethernet eth1: Habilitaci\u00f3n de funciones de seguridad [ 121.907578] tegra-mgbe 6910000.ethernet eth1: Marca de tiempo avanzada IEEE 1588-2008 compatible [ 121.908399] tegra-mgbe 6910000.ethernet eth1: Reloj PTP registrado [ 121.908582] tegra-mgbe 6910000.ethernet eth1: configurando para modo de enlace phy/10gbase-r [ 125.961292] tegra-mgbe 6910000.ethernet eth1: Enlace activo - 1 Gbps/completo - control de flujo rx/tx [ 181.921198] rcu: INFORMACI\u00d3N: rcu_preempt detect\u00f3 bloqueos en CPU/tareas: [ 181.921404] rcu: 7-....: (1 GP detr\u00e1s) idle=540c/1/0x4000000000000002 softirq=1748/1749 fqs=2337 [ 181.921684] rcu: (detectado por 4, t=6002 jiffies, g=1357, q=1254 ncpus=8) [ 181.921878] Enviando NMI desde la CPU 4 a las CPU 7: [ 181.921886] Seguimiento de NMI para la CPU 7 [ 181.922131] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: cargado No contaminado 6.13.0-rc3+ #6 [ 181.922390] Nombre del hardware: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 28/10/2024 [ 181.922658] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 181.922847] pc : handle_softirqs+0x98/0x368 [ 181.922978] lr : __do_softirq+0x18/0x20 [ 181.923095] sp : ffff80008003bf50 [ 181.923189] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000 [ 181.923379] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0 [ 181.924486] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70 [ 181.925568] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000 [ 181.926655] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000 [ 181.931455] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d [ 181.938628] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160 [ 181.945804] x8: ffff8000827b3160 x7: f9157b241586f343 x6: eeb6502a01c81c74 [181.953068] x5: a4acfcdd2e8096bb x4: ffffce78ea277340 x3: 00000000ffffd1e1 [ 181.960329] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000 [ 181.967591] Rastreo de llamadas: [ 181.970043] handle_softirqs+0x98/0x368 (P) [ 181.974240] __do_softirq+0x18/0x20 [ 181.977743] ____do_softirq+0x14/0x28 [ 181.981415] call_on_irq_stack+0x24/0x30 [ 181.985180] do_softirq_own_stack+0x20/0x30 [ 181.989379] __irq_exit_rcu+0x114/0x140 [ 181.993142] irq_exit_rcu+0x14/0x28 [ 181.996816] el1_interrupt+0x44/0xb8 [ 182.000316] el1h_64_irq_handler+0x14/0x20 [ 182.004343] el1h_64_irq+0x80/0x88 [ 182.007755] cpuidle_enter_state+0xc4/0x4a8 (P) [ 182.012305] cpuidle_enter+0x3c/0x58 [ 182.015980] cpuidle_idle_call+0x128/0x1c0 [ 182.020005] do_idle+0xe0/0xf0 [ 182.023155] cpu_startup_entry+0x3c/0x48 [ 182.026917] secondary_start_kernel+0xdc/0x120 [ 182.031379] __secondary_switched+0x74/0x78 [ 212.971162] rcu:---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d8ca113724e79b324f553914cefa9dd6961de152\",\"lessThan\":\"235419f0956e8c60e597aa1619ded8bda7460bb4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d8ca113724e79b324f553914cefa9dd6961de152\",\"lessThan\":\"b04d33cdbc958a3fd57f3544d4f78b99d9d11909\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d8ca113724e79b324f553914cefa9dd6961de152\",\"lessThan\":\"426046e2d62dd19533808661e912b8e8a9eaec16\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.72\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.10\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.72\",\"matchCriteriaId\":\"33E12097-C88A-45B4-9677-2A961A08DD3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"02D604F6-10D1-4F7B-A022-0888406A1121\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/235419f0956e8c60e597aa1619ded8bda7460bb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/426046e2d62dd19533808661e912b8e8a9eaec16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b04d33cdbc958a3fd57f3544d4f78b99d9d11909\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:13:55+00:00",
      "cve": "CVE-2025-21663",
      "id": "CVE-2025-21663",
      "initial_release_date": "2025-01-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: stmmac: dwmac-tegra: Read iommu stream id from device tree",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21663.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:07:32Z",
      "cve": "CVE-2025-21663",
      "id": "CVE-2025-21663",
      "initial_release_date": "2025-01-22T03:48:18Z",
      "product_status:known_affected": "469",
      "product_status:known_not_affected": "249",
      "product_status:recommended": "406",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21663",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21663.json",
      "version": "63"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.