CVE-2025-21650

What it actually does

Out-of-bounds BAR space access in the hns3 driver when reading TQP registers for queues beyond 1024, resulting in invalid memory dereference and kernel paging fault.

Why it matters to the business

Systems using affected network hardware may experience unexpected crashes or instability during routine network configuration or monitoring operations, leading to downtime and potential data loss in high-queue-count environments.

How an attack unfolds

An attacker with local access invokes ethtool register dump operations on an hns3 interface with more than 1024 TQPs; the flawed hclge_fetch_pf_reg function calculates an incorrect BAR address, triggering a kernel fault during the ioctl path.

How to fix it

Update the Linux kernel to a version containing the fix that uses tqp.io_base directly for queue register reads; apply vendor-supplied packages that resolve the segment handling logic.

How to confirm the fix worked

Confirm kernel version includes the hclge_fetch_pf_reg change; reproduce ethtool register dump on hardware with >1024 TQPs and verify absence of paging faults in dmesg.

Typical attack path

1. Obtain local shell or user privileges on a system with hns3 hardware and >1024 TQPs configured
2. Execute ethtool -d or equivalent register-read command against the interface
3. Trigger hclge_get_regs which calls the vulnerable fetch routine
4. Cause kernel paging request fault leading to oops or panic

How to detect it

Review kernel logs for hclge_fetch_pf_reg paging faults and ethtool ioctl entries; correlate with process execution of ethtool or dev_ioctl on affected hardware.

What your security team should do

• Prioritize kernel updates on systems exposing hns3 interfaces with high TQP counts
• Monitor for kernel oops events related to hclge during ethtool usage
• Restrict unprivileged ethtool access via capabilities or SELinux policies until patched