{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21808", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.772Z", "datePublished": "2025-02-27T20:01:00.328Z", "dateUpdated": "2026-08-05T11:54:35.691Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:35.691Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xdp: Disallow attaching device-bound programs in generic mode\n\nDevice-bound programs are used to support RX metadata kfuncs. These\nkfuncs are driver-specific and rely on the driver context to read the\nmetadata. This means they can't work in generic XDP mode. However, there\nis no check to disallow such programs from being attached in generic\nmode, in which case the metadata kfuncs will be called in an invalid\ncontext, leading to crashes.\n\nFix this by adding a check to disallow attaching device-bound programs\nin generic mode." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local syscalls — bpf(BPF_PROG_LOAD) to create the device-bound program and netlink/BPF-link attach with XDP_FLAGS_SKB_MODE — before any packet can trigger the bad kfunc call. The packet trigger can be self-generated on a locally created veth pair, so no network position is needed.\nAC:L - The sequence is fully deterministic and attacker-controlled: create a veth pair, load a dev-bound XDP program calling bpf_xdp_metadata_rx_hash(), attach it in generic mode, then send one frame. No race, no special hardware, and the attacker can groom the kernel stack to control the value the driver callback consumes.\nPR:L - The attach side needs only CAP_NET_ADMIN in the target netns, which any unprivileged user obtains via `unshare -Urn`, and BPF program loading is reachable at low privilege in the delegated-BPF-token container deployments this feature targets. Consistent with kernel.org CNA scoring of other BPF program-loading vulnerabilities.\nUI:N - The attacker performs every step — program load, generic-mode attach, and packet injection — with no action by any other user or administrator.\nS:U - The wild-pointer read and write occur in kernel memory within the same security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The driver kfuncs dereference an uninitialized stack value as a driver-context pointer and return the loaded kernel memory (mlx5 CQE timestamp, ice RSS hash, veth skb_hwtstamps) into the BPF program, which exports it to userspace — a kernel-memory read primitive plus stack-content and KASLR disclosure.\nI:H - veth_xdp_rx_hash() reaches __skb_set_sw_hash() and stores through the bogus skb pointer, giving a write at an attacker-influenceable kernel address; combined with the read primitive this is exploitable memory corruption.\nA:H - Dereferencing a stale stack value as a driver descriptor/skb pointer in softirq (NAPI) context reliably oopses or panics the kernel, and the commit message explicitly states the invalid kfunc context leads to crashes." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/dev.c" ], "versions": [ { "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "b1bc4a35a04cbeb85b6ef5911ec015baa424989f", "status": "affected", "versionType": "git" }, { "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "557707906dd3e34b8a8c265f664d19f95799937e", "status": "affected", "versionType": "git" }, { "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1", "status": "affected", "versionType": "git" }, { "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "3595599fa8360bb3c7afa7ee50c810b4a64106ea", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/dev.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b1bc4a35a04cbeb85b6ef5911ec015baa424989f" }, { "url": "https://git.kernel.org/stable/c/557707906dd3e34b8a8c265f664d19f95799937e" }, { "url": "https://git.kernel.org/stable/c/5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1" }, { "url": "https://git.kernel.org/stable/c/3595599fa8360bb3c7afa7ee50c810b4a64106ea" } ], "title": "net: xdp: Disallow attaching device-bound programs in generic mode", "x_generator": { "engine": "bippy-1.2.0" } } } }