CVE-2025-21772

What it actually does

The flaw permits out-of-bounds memory access and use-after-free conditions during mac partition table parsing because of missing sector release on error, failure to validate sector sizes, and unsafe string handling that can straddle boundaries or read past buffers.

Why it matters to the business

Local attackers can escalate privileges or crash Linux systems handling untrusted block devices, increasing risk to servers, containers, and embedded devices that rely on the kernel; widespread Linux usage amplifies exposure despite low EPSS.

How an attack unfolds

A local attacker prepares a block device containing a crafted mac partition table with invalid offsets, oversized sectors, or unterminated strings, mounts or probes it to trigger the vulnerable code path, and leverages resulting memory corruption for privilege escalation, consistent with observed Linux kernel exploitation patterns by espionage and financially motivated actors.

How to fix it

Apply the upstream kernel fix for proper put_dev_sector handling, sector-size validation, and strnlen/strncmp usage; update restrictedpython (PyPI) to version 5.4 where applicable in dependent environments.

How to confirm the fix worked

Verify kernel source contains the corrected partition probing logic and test with intentionally malformed mac partition tables to confirm no OOB access or crashes occur.

Typical attack path

1. Obtain local user access on target Linux system
2. Create or attach a block device with malicious mac partition table
3. Trigger kernel partition probing via mount or blkid
4. Exploit memory corruption to gain elevated privileges

How to detect it

Review kernel logs for partition probing errors or warnings related to mac tables, sector sizes, or string handling; correlate with creation of unusual block devices or mount attempts by non-root users.

What your security team should do

• Prioritize kernel updates on systems exposing block devices to untrusted input
• Restrict local user access to raw block devices until patched
• Monitor EPSS trend and threat actor activity for any increase in Linux kernel exploits