CVE-2025-21872: Re-mapping the entire mokvar_table is the problem and
the re-mapping is first done in this Fixes: 58c909022a5a ("efi: Support
for MOK variable config table"), so this is the broken commit

CVE-2025-21833: The fix moves dev_pasid dereference inside
WARN_ON_ONCE() as there is a possibility of dev_pasid being NULL, this
dereference is first introduced while adding debugfs support per file in
Fixes: d87731f60931 ("iommu/vt-d: debugfs: Create/remove debugfs file
per {device, pasid}")

CVE-2025-21832E: The problem is that iov_iter_revert() is done before a
negative return check which was was first added in Fixes: 3e1f941dd9f3
("block: fix DIO handling regressions in blkdev_read_iter()")

Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
---
 cve/published/2025/CVE-2025-21832.vulnerable | 1 +
 cve/published/2025/CVE-2025-21833.vulnerable | 1 +
 cve/published/2025/CVE-2025-21872.vulnerable | 1 +
 3 files changed, 3 insertions(+)
 create mode 100644 cve/published/2025/CVE-2025-21832.vulnerable
 create mode 100644 cve/published/2025/CVE-2025-21833.vulnerable
 create mode 100644 cve/published/2025/CVE-2025-21872.vulnerable

diff --git a/cve/published/2025/CVE-2025-21832.vulnerable b/cve/published/2025/CVE-2025-21832.vulnerable
new file mode 100644
index 000000000000..feb566fe0511
--- /dev/null
+++ b/cve/published/2025/CVE-2025-21832.vulnerable
@@ -0,0 +1 @@
+3e1f941dd9f33776b3df4e30f741fe445ff773f3
diff --git a/cve/published/2025/CVE-2025-21833.vulnerable b/cve/published/2025/CVE-2025-21833.vulnerable
new file mode 100644
index 000000000000..86fa313ab645
--- /dev/null
+++ b/cve/published/2025/CVE-2025-21833.vulnerable
@@ -0,0 +1 @@
+d87731f609318a27e9aa3d01cf97798599d32839
diff --git a/cve/published/2025/CVE-2025-21872.vulnerable b/cve/published/2025/CVE-2025-21872.vulnerable
new file mode 100644
index 000000000000..96c8b40950cc
--- /dev/null
+++ b/cve/published/2025/CVE-2025-21872.vulnerable
@@ -0,0 +1 @@
+58c909022a5a56cd1d9e89c8c5461fd1f6a27bb5
-- 
2.47.1

On Sat, May 10, 2025 at 09:10:43AM -0700, Harshit Mogalapalli wrote:
> CVE-2025-21872: Re-mapping the entire mokvar_table is the problem and
> the re-mapping is first done in this Fixes: 58c909022a5a ("efi: Support
> for MOK variable config table"), so this is the broken commit
> 
> CVE-2025-21833: The fix moves dev_pasid dereference inside
> WARN_ON_ONCE() as there is a possibility of dev_pasid being NULL, this
> dereference is first introduced while adding debugfs support per file in
> Fixes: d87731f60931 ("iommu/vt-d: debugfs: Create/remove debugfs file
> per {device, pasid}")
> 
> CVE-2025-21832E: The problem is that iov_iter_revert() is done before a

I don't think CVE entries have "E" on the end of them :)

I'll edit this when I apply it in a few minutes, thanks!

greg k-h

Hi Greg,

On 10/05/25 22:17, Greg KH wrote:
> On Sat, May 10, 2025 at 09:10:43AM -0700, Harshit Mogalapalli wrote:
>> CVE-2025-21872: Re-mapping the entire mokvar_table is the problem and
>> the re-mapping is first done in this Fixes: 58c909022a5a ("efi: Support
>> for MOK variable config table"), so this is the broken commit
>>
>> CVE-2025-21833: The fix moves dev_pasid dereference inside
>> WARN_ON_ONCE() as there is a possibility of dev_pasid being NULL, this
>> dereference is first introduced while adding debugfs support per file in
>> Fixes: d87731f60931 ("iommu/vt-d: debugfs: Create/remove debugfs file
>> per {device, pasid}")
>>
>> CVE-2025-21832E: The problem is that iov_iter_revert() is done before a
> 
> I don't think CVE entries have "E" on the end of them :)
> 

Oops, sorry for that, that was a typo, I remember how this happened, I 
copied starting from -2025.. and pasted it in incorrect mode, that ended 
up leaving a E from CVE moved to the end, missed fixing it.

> I'll edit this when I apply it in a few minutes, thanks!
>

Thanks a lot.

Regards,
Harshit

> greg k-h