{"id":"CVE-2025-21735","revision":"4c6862527e574ad18e3bc7c242493525","records":[{"revision":"4c6862527e574ad18e3bc7c242493525","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-21735","aliases":[],"title":"NFC: nci: Add bounds checking in nci_hci_create_pipe()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: Add bounds checking in nci_hci_create_pipe()\n\nThe \"pipe\" variable is a u8 which comes from the network.  If it's more\nthan 127, then it results in memory corruption in the caller,\nnci_hci_connect_gate().","state":0,"publishedAt":"2025-02-27T02:12:12.202+00:00","modifiedAt":"2026-10-15T01:03:52.736+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/nfc/nci/hci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a1b0b9415817c14d207921582f269d03f848b69f\",\n                            \"lessThan\": \"bd249109d266f1d52548c46634a15b71656e0d44\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a1b0b9415817c14d207921582f269d03f848b69f\",\n                            \"lessThan\": \"674e17c5933779a8bf5c15d596fdfcb5ccdebbc2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a1b0b9415817c14d207921582f269d03f848b69f\",\n                            \"lessThan\": \"10b3f947b609713e04022101f492d288a014ddfa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a1b0b9415817c14d207921582f269d03f848b69f\",\n                            \"lessThan\": \"d5a461c315e5ff92657f84d8ba50caa5abf5c22a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a1b0b9415817c14d207921582f269d03f848b69f\",\n                            \"lessThan\": \"172cdfc3a5ea20289c58fb73dadc6fd4a8784a4e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a1b0b9415817c14d207921582f269d03f848b69f\",\n                            \"lessThan\": \"2ae4bade5a64d126bd18eb66bd419005c5550218\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a1b0b9415817c14d207921582f269d03f848b69f\",\n                            \"lessThan\": \"59c7ed20217c0939862fbf8145bc49d5b3a13f4f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a1b0b9415817c14d207921582f269d03f848b69f\",\n                            \"lessThan\": \"110b43ef05342d5a11284cc8b21582b698b4ef1c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/nfc/nci/hci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.291\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.235\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.179\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.129\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.78\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.14\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.3\",\n                            \"lessThanOrEqual\": \"6.13.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/bd249109d266f1d52548c46634a15b71656e0d44","https://git.kernel.org/stable/c/674e17c5933779a8bf5c15d596fdfcb5ccdebbc2","https://git.kernel.org/stable/c/10b3f947b609713e04022101f492d288a014ddfa","https://git.kernel.org/stable/c/d5a461c315e5ff92657f84d8ba50caa5abf5c22a","https://git.kernel.org/stable/c/172cdfc3a5ea20289c58fb73dadc6fd4a8784a4e","https://git.kernel.org/stable/c/2ae4bade5a64d126bd18eb66bd419005c5550218","https://git.kernel.org/stable/c/59c7ed20217c0939862fbf8145bc49d5b3a13f4f","https://git.kernel.org/stable/c/110b43ef05342d5a11284cc8b21582b698b4ef1c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21735","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-21735","identifiers":["CVE-2025-21735"]},"retained":false,"historicalAffected":[]}],"coverage":[]}