CVE-2025-22104

What it actually does

Out-of-bounds read in the ibmvnic driver when casting a hex dump buffer to an 8-byte long and using string formatters; non-multiples of 8 trigger slab-out-of-bounds reads.

Why it matters to the business

Local information disclosure or kernel crashes on systems using the ibmvnic driver; older kernels remain exposed 560 days after disclosure with low but steady exploit probability.

How an attack unfolds

A local attacker triggers ibmvnic_open followed by ibmvnic_login with a login buffer whose length is not a multiple of 8, causing the driver to read past the allocated slab region while printing the hex dump.

How to fix it

Upgrade to a kernel containing commit ae6b1d6c1acee3a2000394d83ec9f1028321e207; for RHEL 9.4 EUS apply the bzip2 packages fixed in 0:1.0.8-8.el9_4.1 where applicable and reboot.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit; reproduce a login buffer print with non-multiple-of-8 length and verify absence of KASAN slab-out-of-bounds reports in ibmvnic_login.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Cause the ibmvnic network interface to open and perform login
3. Supply or induce a buffer whose size is not a multiple of 8 bytes
4. Trigger the vulnerable hex-dump path to perform the out-of-bounds read

How to detect it

Search kernel logs and dmesg for KASAN slab-out-of-bounds messages referencing ibmvnic_login and hex dump output; correlate with process names that open ibmvnic devices.

What your security team should do

• Prioritize kernel updates on all systems exposing ibmvnic interfaces
• Review kernel logs for prior KASAN reports matching the described signature
• Harden local access controls to reduce attack surface until patches are deployed