CVE-2025-21804: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21804 affects the Linux kernel's PCI subsystem, specifically in the rcar-ep driver. The vulnerability was discovered in January 2025 and publicly disclosed in February 2025. The issue exists in the rcarpcieparseoutboundranges() function where an incorrect variable is used when calling devmrequestmem_region() (Kernel Commit).

The vulnerability stems from using a stack-based string variable (outboundname) to store a dynamically computed resource name, which is then passed as an argument to the devmrequestmemregion() macro. This implementation can lead to undefined behavior as the string may not be properly null-terminated. The issue was introduced in the commit that added endpoint mode support to the Renesas R-Car PCIe controller (Kernel Commit).

The vulnerability can manifest in various ways depending on memory contents. Common symptoms include garbage characters appearing after colons in /proc/iomem output. In severe cases, if no NULL-terminator is found in memory, the system might crash due to the string iterator overrunning and accessing unmapped memory above the stack (Ubuntu Security).

A fix has been developed and merged into the Linux kernel, replacing the problematic outbound_name variable with res->name, which is the name of the previously requested resource. The patch has been backported to multiple stable kernel versions. Users are advised to update their systems to patched kernel versions (Kernel Commit).