High 7.8Published Feb 26, 2025

CVE-2025-21724iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()

Updated under an hour ago (Oct 27, 2026, 8:00 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63) the shift operation overflows, as the result cannot be represented in a 32-bit type. To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type to match the operand's type.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	58ccf0190d19d9a8a41f8a02b9e06742b58df4a1 builds before 44d9c94b7a3f29a3e07c4753603a35e9b28842a3; 58ccf0190d19d9a8a41f8a02b9e06742b58df4a1 builds before 38ac76fc06bc6826a3e4b12a98efbe98432380a9; from 58ccf0190d19d9a8a41f8a02b9e06742b58df4a1 before d5d33f01b86af44b23eea61ee309e4ef22c0cdfe; from 58ccf0190d19d9a8a41f8a02b9e06742b58df4a1 before b1f8453b8ff1ab79a03820ef608256c499769cb6; from 58ccf0190d19d9a8a41f8a02b9e06742b58df4a1 before e24c1551059268b37f6f40639883eafb281b8b9c	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
linux linux_kernel linux:linux_kernel	from 6.1 before 6.1.129; from 6.2 before 6.6.76; from 6.7 before 6.12.13; from 6.13 before 6.13.2	NVD

References

References

https://git.kernel.org/stable/c/44d9c94b7a3f29a3e07c4753603a35e9b28842a3	patch
https://git.kernel.org/stable/c/38ac76fc06bc6826a3e4b12a98efbe98432380a9	patch
https://git.kernel.org/stable/c/d5d33f01b86af44b23eea61ee309e4ef22c0cdfe	patch
https://git.kernel.org/stable/c/b1f8453b8ff1ab79a03820ef608256c499769cb6	patch
https://git.kernel.org/stable/c/e24c1551059268b37f6f40639883eafb281b8b9c	patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.