CVE-2025-21650

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue

The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs

1024-1279 are in different BAR space addresses. However,

hclge_fetch_pf_reg does not distinguish the tqp space information when

reading the tqp space information. When the number of TQPs is greater

than 1024, access bar space overwriting occurs.

The problem of different segments has been considered during the

initialization of tqp.io_base. Therefore, tqp.io_base is directly used

when the queue is read in hclge_fetch_pf_reg.

The error message:

Unable to handle kernel paging request at virtual address ffff800037200000

pc : hclge_fetch_pf_reg+0x138/0x250 [hclge]

lr : hclge_get_regs+0x84/0x1d0 [hclge]

Call trace:

hclge_fetch_pf_reg+0x138/0x250 [hclge]

hclge_get_regs+0x84/0x1d0 [hclge]

hns3_get_regs+0x2c/0x50 [hns3]

ethtool_get_regs+0xf4/0x270

dev_ethtool+0x674/0x8a0

dev_i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References