CVE-2025-21724

What it actually does

Shift-out-of-bounds in iova_bitmap_offset_to_index() due to signed int shift of constant 1 by pgshift (unsigned long) exceeding 31 bits, causing undefined behavior in kernel memory bitmap handling.

Why it matters to the business

Local memory corruption risk on Linux systems with large page shifts can lead to kernel instability, crashes, or privilege escalation, increasing operational downtime and requiring urgent patching across fleets.

How an attack unfolds

A local attacker invokes the vulnerable bitmap offset function with a pgshift value greater than 31, triggering the oversized shift on a 32-bit constant and resulting in undefined kernel behavior that may be leveraged for memory corruption or escalation, consistent with patterns seen in related kernel privilege escalation campaigns.

How to fix it

Update the Linux kernel to a version containing the 1UL fix for the shift operation; for listed packages apply the corresponding fixed release such as gradio 2.5.0 where applicable.

How to confirm the fix worked

Confirm kernel build includes the 1UL constant change in iova_bitmap_offset_to_index(); test with UBSAN enabled and large pgshift values; verify package versions match fixed releases.

Typical attack path

1. Obtain local user access on affected Linux system
2. Trigger iova_bitmap_offset_to_index() with pgshift > 31
3. Exploit resulting undefined behavior for memory corruption
4. Escalate privileges or cause denial of service

How to detect it

Inspect kernel logs for UBSAN shift-out-of-bounds reports referencing iova_bitmap; correlate with local process activity attempting large page shift operations; review related kernel privilege escalation artifacts from similar issues.

What your security team should do

• Prioritize kernel updates on all Linux hosts within patch windows
• Monitor for similar shift-related issues in kernel bitmap code
• Apply fixed package versions such as gradio 2.5.0 where components are present
• Review local privilege boundaries and limit untrusted code execution