Linux Kernel up to 6.17.12/6.18.1 iommu_mmio_write out-of-bounds

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.17.12/6.18.1. It has been rated as critical. The affected element is the function iommu_mmio_write. The manipulation leads to out-of-bounds. This vulnerability is documented as CVE-2025-68760. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.17.12/6.18.1 and classified as problematic. This issue affects the function iommu_mmio_write. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show In iommu_mmio_write(), it validates the user-provided offset with the check: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`. This assumes a 4-byte access. However, the corresponding show handler, iommu_mmio_show(), uses readq() to perform an 8-byte (64-bit) read. If a user provides an offset equal to `mmio_phys_end - 4`, the check passes, and will lead to a 4-byte out-of-bounds read. Fix this by adjusting the boundary check to use sizeof(u64), which corresponds to the size of the readq() operation.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2025-68760 since 12/24/2025. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 281906 (Linux Distros Unpatched Vulnerability : CVE-2025-68760), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.17.13, 6.18.2 or 6.19-rc1 eliminates this vulnerability. Applying the patch b959df804c33913dbfdb90750f2d693502b3d126/0ec4aaf5f3f559716a6559f3d6d9616e9470bed6/a0c7005333f9a968abb058b1d77bbcd7fb7fd1e7 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (281906) and CERT Bund (WID-SEC-2026-0009). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Microsoft Azure Linux
• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.17.0
• 6.17.1
• 6.17.2
• 6.17.3
• 6.17.4
• 6.17.5
• 6.17.6
• 6.17.7
• 6.17.8
• 6.17.9
• 6.17.10
• 6.17.11
• 6.17.12
• 6.18.0
• 6.18.1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion