CVE-2025-21954

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21954

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: netmem: prevent TX of unreadable skbs Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the device's TX path, as the device may call dma-mapping APIs on dma addrs that should not be passed to it. Fix this by preventing the xmit of unreadable skbs. Tested by configuring tc redirect: sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \ tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1 Before, I see unreadable skbs in the driver's TX path passed to dma mapping APIs. After, I don't see unreadable skbs in the driver's TX path passed to dma mapping APIs.

References
Link Resource
https://git.kernel.org/stable/c/1c17c8ced25c5fbe424c7ad7ea11d33014a986b1 Patch
https://git.kernel.org/stable/c/454825019d2f0c59e5174ece9e713f45ad80beff Patch
https://git.kernel.org/stable/c/f3600c867c99a2cc8038680ecf211089c50e7971 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*
History

31 Oct 2025, 18:19

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netmem: evitar TX de skbs ilegibles Actualmente en árboles estables tenemos soporte para netmem/devmem RX pero no TX. No es seguro reenviar/redirigir un paquete netmem ilegible RX en la ruta TX del dispositivo, ya que el dispositivo puede llamar a las API de mapeo DMA en direcciones DMA que no se le deben pasar. Arregle esto al evitar la xmit de skbs ilegibles. Probado al configurar tc redirect: sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \ tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1 Antes, veía skbs ilegibles en la ruta TX del controlador pasada a las API de mapeo DMA. Después, no veo skbs ilegibles en la ruta TX del controlador pasada a las API de mapeo de DMA.
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/1c17c8ced25c5fbe424c7ad7ea11d33014a986b1 - () https://git.kernel.org/stable/c/1c17c8ced25c5fbe424c7ad7ea11d33014a986b1 - Patch
References () https://git.kernel.org/stable/c/454825019d2f0c59e5174ece9e713f45ad80beff - () https://git.kernel.org/stable/c/454825019d2f0c59e5174ece9e713f45ad80beff - Patch
References () https://git.kernel.org/stable/c/f3600c867c99a2cc8038680ecf211089c50e7971 - () https://git.kernel.org/stable/c/f3600c867c99a2cc8038680ecf211089c50e7971 - Patch

01 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 16:15

Updated : 2025-10-31 18:19

NVD link : CVE-2025-21954

Mitre link : CVE-2025-21954

CVE.ORG link : CVE-2025-21954

JSON object : View

Products Affected

linux

CWE
CWE-401

Missing Release of Memory after Effective Lifetime