Cloudanix VulnDB

CVE-2025-21663

None

CVSS

—

EPSS

0.4%

Published

Jan 21, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A configuration error in certain Nvidia-based network hardware can cause computers to crash or freeze when using extra network ports.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Misconfiguration
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Hardcoded IOMMU Stream ID for MGBE0 in dwmac-tegra driver causes incorrect SID programming for additional controllers, triggering softirq timeouts, RCU stalls, and kernel panics on link events.

Why it matters to the business

Systems with multiple Tegra MGBE Ethernet interfaces experience instability, resets, and potential downtime when non-primary controllers are used, increasing operational risk for affected embedded deployments.

How an attack unfolds

An attacker with local or physical access configures or triggers network link events on secondary MGBE controllers; the misconfigured SID leads to watchdog timeouts and RCU-detected stalls that panic the kernel.

How to fix it

Update the Linux kernel to a version containing commit 235419f0956e8c60e597aa1619ded8bda7460bb4 or later; rebuild and deploy the stmmac dwmac-tegra driver with device-tree sourced Stream IDs.

How to confirm the fix worked

Verify the updated driver reads the SID from device tree properties instead of hardcoding MGBE0; confirm no NETDEV WATCHDOG or RCU stall messages occur on secondary controllers after link events.

Typical attack path

  1. Identify or provision hardware exposing MGBE1 or higher controllers
  2. Connect Ethernet link to trigger driver initialization and link-up events
  3. Observe softirq watchdog and RCU stall messages culminating in kernel panic

How to detect it

Search kernel logs for NETDEV WATCHDOG transmit queue timeouts, rcu_preempt stall messages, and NMI backtraces involving handle_softirqs on Tegra MGBE interfaces.

What your security team should do

  • Prioritize kernel upgrades on all Tegra-based platforms using multiple MGBE interfaces
  • Audit device trees to ensure per-controller IOMMU Stream IDs are defined
  • Monitor kernel logs for softirq timeouts on ethernet interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree Nvidia's Tegra MGBE controllers require the IOMMU "Stream ID" (SID) to be written to the MGBE_WRAP_AXI_ASID0_CTRL register. The current driver is hard coded to use MGBE0's SID for all controllers. This causes softirq time outs and kernel panics when using controllers other than MGBE0. Example dmesg errors when an ethernet cable is connected to MGBE1: [ 116.133290] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [ 121.851283] tegra-mgbe 6910000.ethernet eth1: NETDEV WATCHDOG: CPU: 5: transmit queue 0 timed out 5690 ms [ 121.851782] tegra-mgbe 6910000.ethernet eth1: Reset adapter. [ 121.892464] tegra-mgbe 6910000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-0 [ 121.905920] tegra-mgbe 6910000.ethernet eth1: PHY [stmmac-1:00] driver [Aquantia AQR113] (irq=171) [ 121.907356] tegra-mgbe 6910000.ethernet eth1: Enabling Safety Features [ 121.907578] tegra-mgbe 6910000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported [ 121.908399] tegra-mgbe 6910000.ethernet eth1: registered PTP clock [ 121.908582] tegra-mgbe 6910000.ethernet eth1: configuring for phy/10gbase-r link mode [ 125.961292] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [ 181.921198] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 181.921404] rcu: 7-....: (1 GPs behind) idle=540c/1/0x4000000000000002 softirq=1748/1749 fqs=2337 [ 181.921684] rcu: (detected by 4, t=6002 jiffies, g=1357, q=1254 ncpus=8) [ 181.921878] Sending NMI from CPU 4 to CPUs 7: [ 181.921886] NMI backtrace for cpu 7 [ 181.922131] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: loaded Not tainted 6.13.0-rc3+ #6 [ 181.922390] Hardware name: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 10/28/2024 [ 181.922658] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 181.922847] pc : handle_softirqs+0x98/0x368 [ 181.922978] lr : __do_softirq+0x18/0x20 [ 181.923095] sp : ffff80008003bf50 [ 181.923189] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000 [ 181.923379] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0 [ 181.924486] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70 [ 181.925568] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000 [ 181.926655] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000 [ 181.931455] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d [ 181.938628] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160 [ 181.945804] x8 : ffff8000827b3160 x7 : f9157b241586f343 x6 : eeb6502a01c81c74 [ 181.953068] x5 : a4acfcdd2e8096bb x4 : ffffce78ea277340 x3 : 00000000ffffd1e1 [ 181.960329] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000 [ 181.967591] Call trace: [ 181.970043] handle_softirqs+0x98/0x368 (P) [ 181.974240] __do_softirq+0x18/0x20 [ 181.977743] ____do_softirq+0x14/0x28 [ 181.981415] call_on_irq_stack+0x24/0x30 [ 181.985180] do_softirq_own_stack+0x20/0x30 [ 181.989379] __irq_exit_rcu+0x114/0x140 [ 181.993142] irq_exit_rcu+0x14/0x28 [ 181.996816] el1_interrupt+0x44/0xb8 [ 182.000316] el1h_64_irq_handler+0x14/0x20 [ 182.004343] el1h_64_irq+0x80/0x88 [ 182.007755] cpuidle_enter_state+0xc4/0x4a8 (P) [ 182.012305] cpuidle_enter+0x3c/0x58 [ 182.015980] cpuidle_idle_call+0x128/0x1c0 [ 182.020005] do_idle+0xe0/0xf0 [ 182.023155] cpu_startup_entry+0x3c/0x48 [ 182.026917] secondary_start_kernel+0xdc/0x120 [ 182.031379] __secondary_switched+0x74/0x78 [ 212.971162] rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 7-.... } 6103 jiffies s: 417 root: 0x80/. [ 212.985935] rcu: blocking rcu_node structures (internal RCU debug): [ 212.992758] Sending NMI from CPU 0 to CPUs 7: [ 212.998539] NMI backtrace for cpu 7 [ 213.004304] CPU: 7 UID: 0 PI ---truncated---

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 linux 0 No fix
Debian:13 linux 0 6.12.10-1
Linux Kernel 6.2.0 6.6.72
Mageia:9 dwarves 0 1.29-1.mga9
Mageia:9 kernel 0 6.6.74-1.mga9
Mageia:9 kernel-linus 0 6.6.74-1.mga9
Mageia:9 kmod-virtualbox 0 7.0.24-64.mga9
Mageia:9 kmod-xtables-addons 0 3.24-70.mga9
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_8 0 1-150600.1.3.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_8 0 1-150600.13.3.2
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-64kb 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default-base 0 6.4.0-150600.23.38.1.150600.12.16.2
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-source 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-zfcpdump 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-coco 0 6.4.0-15061.15.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-coco_debug 0 6.4.0-15061.15.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-source-coco 0 6.4.0-15061.15.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-syms-coco 0 6.4.0-15061.15.coco15sp6.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-docs 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-obs-build 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-source 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-syms 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Legacy 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-azure 0 6.4.0-150600.8.26.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure 0 6.4.0-150600.8.26.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-syms-azure 0 6.4.0-150600.8.26.1
SUSE:Linux Enterprise Workstation Extension 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Real Time Module 15 SP6 kernel-rt 0 6.4.0-150600.10.26.1
SUSE:Real Time Module 15 SP6 kernel-rt_debug 0 6.4.0-150600.10.26.1
SUSE:Real Time Module 15 SP6 kernel-source-rt 0 6.4.0-150600.10.26.1
SUSE:Real Time Module 15 SP6 kernel-syms-rt 0 6.4.0-150600.10.26.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 No fix
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 No fix
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm-5.15 0 No fix
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 No fix
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS linux 0 No fix
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 No fix
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1029.31~22.04.1
Ubuntu:22.04:LTS linux-azure 0 No fix
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1029.34~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 No fix
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1030.32~22.04.1
Ubuntu:22.04:LTS linux-gke 0 No fix
Ubuntu:22.04:LTS linux-gkeop 0 No fix
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-60.63~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 No fix
Ubuntu:22.04:LTS linux-ibm-6.8 0 6.8.0-1026.26~22.04.1
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iotg 0 No fix
Ubuntu:22.04:LTS linux-kvm 0 No fix
Ubuntu:22.04:LTS linux-lowlatency 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-60.63.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.8 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1028.31~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.8 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1026.27~22.04.1
Ubuntu:22.04:LTS linux-raspi 0 No fix
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-62.65~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 No fix
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS:for:NVIDIA:BlueField linux-bluefield 0 No fix
Ubuntu:24.04:LTS linux 0 No fix
Ubuntu:24.04:LTS linux 0 6.8.0-60.63
Ubuntu:24.04:LTS linux-aws 0 No fix
Ubuntu:24.04:LTS linux-aws 0 6.8.0-1029.31
Ubuntu:24.04:LTS linux-azure 0 No fix
Ubuntu:24.04:LTS linux-azure 0 6.8.0-1029.34
Ubuntu:24.04:LTS linux-azure-6.11 0 6.11.0-1012.12~24.04.1
Ubuntu:24.04:LTS linux-azure-fde 0 No fix
Ubuntu:24.04:LTS linux-azure-nvidia 0 6.8.0-1016.17
Ubuntu:24.04:LTS linux-gcp 0 No fix
Ubuntu:24.04:LTS linux-gcp 0 6.8.0-1030.32
Ubuntu:24.04:LTS linux-gcp-6.11 0 6.11.0-1011.11~24.04.1
Ubuntu:24.04:LTS linux-gke 0 No fix
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1025.29
Ubuntu:24.04:LTS linux-gkeop 0 No fix
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1012.14
Ubuntu:24.04:LTS linux-hwe-6.11 0 6.11.0-21.21~24.04.1
Ubuntu:24.04:LTS linux-ibm 0 No fix
Ubuntu:24.04:LTS linux-ibm 0 6.8.0-1026.26
Ubuntu:24.04:LTS linux-lowlatency 0 No fix
Ubuntu:24.04:LTS linux-lowlatency 0 6.8.0-60.63.1
Ubuntu:24.04:LTS linux-nvidia 0 No fix
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1028.31
Ubuntu:24.04:LTS linux-nvidia-6.11 0 6.11.0-1007.7
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 No fix
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1028.31.1
Ubuntu:24.04:LTS linux-nvidia-tegra 0 No fix
Ubuntu:24.04:LTS linux-nvidia-tegra 0 6.8.0-1008.8
Ubuntu:24.04:LTS linux-oem-6.11 0 No fix
Ubuntu:24.04:LTS linux-oem-6.11 0 6.11.0-1017.17
Ubuntu:24.04:LTS linux-oem-6.8 0 No fix
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1028.28
Ubuntu:24.04:LTS linux-oracle 0 No fix
Ubuntu:24.04:LTS linux-oracle 0 6.8.0-1026.27

Related vulnerabilities