by Kastro
Paper/Archive/CVE-2025-21954

CVE-2025-21954

Linux Linux — netmem: prevent TX of unreadable skbs

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.2.432 × 208.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: netmem: prevent TX of unreadable skbs Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the device's TX path, as the device may call dma-mapping APIs on dma addrs that should not be passed to it. Fix this by preventing the xmit of unreadable skbs. Tested by configuring tc redirect: sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \ tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1 Before, I see unreadable skbs in the driver's TX path passed to dma mapping APIs. After, I don't see unreadable skbs in the driver's TX path passed to dma mapping APIs.

Affected

ProductAffectedFixed inSource
Linux65249feb6b3df9e17bab5911ee56fa7b0971e231 – < 454825019d2f0c59e5174ece9e713f45ad80beff454825019d2f0c59e5174ece9e713f45ad80beffCNA
Linux65249feb6b3df9e17bab5911ee56fa7b0971e231 – < 1c17c8ced25c5fbe424c7ad7ea11d33014a986b11c17c8ced25c5fbe424c7ad7ea11d33014a986b1CNA
Linux65249feb6b3df9e17bab5911ee56fa7b0971e231 – < f3600c867c99a2cc8038680ecf211089c50e7971f3600c867c99a2cc8038680ecf211089c50e7971CNA
Linux6.126.12.20CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgit.kernel.org/stable/c/454825019d2f0c59e5174ece9e713f45ad80beffrefgit.kernel.org/stable/c/1c17c8ced25c5fbe424c7ad7ea11d33014a986b1refgit.kernel.org/stable/c/f3600c867c99a2cc8038680ecf211089c50e7971