CVE-2025-21668: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21668 is a vulnerability discovered in the Linux kernel affecting the pmdomain component, specifically in the imx8mp-blk-ctrl module. The vulnerability was disclosed on January 31, 2025, and involves a missing loop break condition in the imx8mp_blk_ctrl_remove() function (NVD, RedHat).

The vulnerability stems from a programming error where imx8mp_blk_ctrl_remove() continues the for loop until an out-of-bounds exception occurs, instead of properly breaking at the end of the domain list. The issue has been assigned a CVSS v3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating moderate severity with local access required (RedHat).

The vulnerability can lead to an out-of-bounds exception during system operations, potentially causing system instability or crashes. This primarily affects systems using the IMX8MP hardware platform with the affected kernel versions (RedHat).

The vulnerability requires local access and low privileges to exploit. It affects Red Hat Enterprise Linux 9 kernel and kernel-rt packages, while earlier versions (RHEL 6, 7, and 8) are not affected (RedHat).

The vulnerability has been patched in various Linux distributions. Debian has released version 6.1.128-1 to address this issue, and the fix involves adding a proper loop break condition to the imx8mp_blk_ctrl_remove() function (Debian, Kernel).