CVE-2025-21905 [High] | Out-of-bounds Read in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's the last TLV in the file, it can perhaps even read beyond the end of the file buffer. Fix that by limiting the print format to the size of the buffer we have.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.01%	0.18%	+0.17%
2	2026-05-11	0.07%	0.01%	-0.06%
3	2026-01-26	—	0.07%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.01%

0.18%

+0.17%

2026-05-11

0.07%

0.01%

-0.06%

2026-01-26

—

0.07%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.1	3.1	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	5.2	[email protected]
7.1	3.1	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	5.2	134c704f-9b21-4f2e-91b3-4a467353bcc0

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.1

3.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

5.2

[email protected]

7.1

3.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

5.2

134c704f-9b21-4f2e-91b3-4a467353bcc0

OS Trackers for CVE-2025-21905

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2025-21905 not yet assigned priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6.	https://security-tracker.debian.org/tracker/CVE-2025-21905
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2025-21905
`suse`	medium	—	https://www.suse.com/security/cve/CVE-2025-21905/
`ubuntu`	medium	CVE-2025-21905 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1551 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1145, released 192, ignored 150, not-affected 63, needed 1.	https://ubuntu.com/security/CVE-2025-21905

Affected software / configurations for CVE-2025-21905

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 5.2, < 5.4.291	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.5, < 5.10.235	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.11, < 5.15.179	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.16, < 6.1.131	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.2, < 6.6.83	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.7, < 6.12.19	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.13, < 6.13.7	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	6.14	cpe:2.3:o:linux:linux_kernel:6.14:rc1::::::
linux	linux_kernel	6.14	cpe:2.3:o:linux:linux_kernel:6.14:rc2::::::
linux	linux_kernel	6.14	cpe:2.3:o:linux:linux_kernel:6.14:rc3::::::
linux	linux_kernel	6.14	cpe:2.3:o:linux:linux_kernel:6.14:rc4::::::
linux	linux_kernel	6.14	cpe:2.3:o:linux:linux_kernel:6.14:rc5::::::

References for CVE-2025-21905

URL	Tags
https://git.kernel.org/stable/c/38f0d398b6d7640d223db69df022c4a232f24774	Patch
https://git.kernel.org/stable/c/47616b82f2d42ea2060334746fed9a2988d845c9	Patch
https://git.kernel.org/stable/c/59cdda202829d1d6a095d233386870a59aff986f	Patch
https://git.kernel.org/stable/c/88ed69f924638c7503644e1f8eed1e976f3ffa7a	Patch
https://git.kernel.org/stable/c/b02f8d5a71c8571ccf77f285737c566db73ef5e5	Patch
https://git.kernel.org/stable/c/c0e626f2b2390472afac52dfe72b29daf9ed8e1d	Patch
https://git.kernel.org/stable/c/e0dc2c1bef722cbf16ae557690861e5f91208129	Patch
https://git.kernel.org/stable/c/f265e6031d0bc4fc40c4619cb42466722b46eaa9	Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

URL

CVE-2025-21905 | wifi: iwlwifi: limit printed string from FW file

Exploit prediction scoring system (EPSS) score for CVE-2025-21905

Common vulnerability scoring system (CVSS) metrics for CVE-2025-21905

Weakness enumeration for CVE-2025-21905

OS Trackers for CVE-2025-21905

Affected software / configurations for CVE-2025-21905

References for CVE-2025-21905