{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21812", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.774Z", "datePublished": "2025-02-27T20:01:02.837Z", "dateUpdated": "2026-08-05T11:54:40.014Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:40.014Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: rcu protect dev->ax25_ptr\n\nsyzbot found a lockdep issue [1].\n\nWe should remove ax25 RTNL dependency in ax25_setsockopt()\n\nThis should also fix a variety of possible UAF in ax25.\n\n[1]\n\nWARNING: possible circular locking dependency detected\n6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Not tainted\n------------------------------------------------------\nsyz.5.1818/12806 is trying to acquire lock:\n ffffffff8fcb3988 (rtnl_mutex){+.+.}-{4:4}, at: ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680\n\nbut task is already holding lock:\n ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]\n ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-> #1 (sk_lock-AF_AX25){+.+.}-{0:0}:\n lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n lock_sock_nested+0x48/0x100 net/core/sock.c:3642\n lock_sock include/net/sock.h:1618 [inline]\n ax25_kill_by_device net/ax25/af_ax25.c:101 [inline]\n ax25_device_event+0x24d/0x580 net/ax25/af_ax25.c:146\n notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85\n __dev_notify_flags+0x207/0x400\n dev_change_flags+0xf0/0x1a0 net/core/dev.c:9026\n dev_ifsioc+0x7c8/0xe70 net/core/dev_ioctl.c:563\n dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:820\n sock_do_ioctl+0x240/0x460 net/socket.c:1234\n sock_ioctl+0x626/0x8e0 net/socket.c:1339\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n-> #0 (rtnl_mutex){+.+.}-{4:4}:\n check_prev_add kernel/locking/lockdep.c:3161 [inline]\n check_prevs_add kernel/locking/lockdep.c:3280 [inline]\n validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904\n __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226\n lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n __mutex_lock_common kernel/locking/mutex.c:585 [inline]\n __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735\n ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680\n do_sock_setsockopt+0x3af/0x720 net/socket.c:2324\n __sys_setsockopt net/socket.c:2349 [inline]\n __do_sys_setsockopt net/socket.c:2355 [inline]\n __se_sys_setsockopt net/socket.c:2352 [inline]\n __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nother info that might help us debug this:\n\n Possible unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n lock(sk_lock-AF_AX25);\n lock(rtnl_mutex);\n lock(sk_lock-AF_AX25);\n lock(rtnl_mutex);\n\n *** DEADLOCK ***\n\n1 lock held by syz.5.1818/12806:\n #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]\n #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574\n\nstack backtrace:\nCPU: 1 UID: 0 PID: 12806 Comm: syz.5.1818 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074\n check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206\n check_prev_add kernel/locking/lockdep.c:3161 [inline]\n check_prevs_add kernel/lockin\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The controllable attack path is an AF_AX25 socket driven by local syscalls (setsockopt SO_BINDTODEVICE, connect/sendmsg autobind, close), which is what both frees the ax25_dev and re-dereferences the dangling dev->ax25_ptr. Although received AX.25 frames also read dev->ax25_ptr in ax25_rcv(), an adjacent radio/L2 peer cannot itself cause the free, so the attacker must be local.\nAC:L - No race needs to be won: SO_BINDTODEVICE stores ax25->ax25_dev without a reference while ax25_release() drops one, so a single setsockopt+close deterministically drives the refcount to zero and kfree()s the object still published in dev->ax25_ptr. The pure device-down race variant is also attacker-driven by spinning setsockopt/connect in a loop.\nPR:L - ax25_create() imposes no capability check for SOCK_DGRAM/SOCK_SEQPACKET, and the AF_AX25 module autoloads via the net-pf-3 alias, so any unprivileged local user in the init namespace can reach every vulnerable path. Root is only needed for the one-time deployment setup of the AX.25 port, not by the attacker.\nUI:N - The entire sequence is performed by the attacker's own process through socket(), setsockopt(), connect()/sendmsg() and close(); no victim action is involved.\nS:U - The freed ax25_dev and the corrupted kernel heap are entirely within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - After the free, ax25_fillin_cb() copies bytes from the reclaimed slab object into the socket's t1/t2/t3/n2/paclen/window/backoff fields, which userspace reads back with getsockopt() — a direct kernel heap disclosure — and the general UAF read of ax25_dev->dev/->forward enables broader information leakage.\nI:H - The dangling pointer yields repeated refcount_dec() and stores to ax25_dev->forward and ->device_up into memory that has been reallocated for other kernel objects, giving a controlled decrement/write primitive on a groomed heap that is exploitable for privilege escalation.\nA:H - Dereferencing and freeing the already-freed ax25_dev reliably produces a kernel oops/panic (and netdev refcount underflow), and the same commit fixes a genuine sk_lock-AF_AX25 versus rtnl_mutex ABBA deadlock that permanently wedges the rtnl mutex and with it the entire networking stack." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/netdevice.h", "include/net/ax25.h", "net/ax25/af_ax25.c", "net/ax25/ax25_dev.c", "net/ax25/ax25_ip.c", "net/ax25/ax25_out.c", "net/ax25/ax25_route.c" ], "versions": [ { "version": "c433570458e49bccea5c551df628d058b3526289", "lessThan": "2802ed4ced27ebd474828fc67ffd7d66f11e3605", "status": "affected", "versionType": "git" }, { "version": "c433570458e49bccea5c551df628d058b3526289", "lessThan": "7705d8a7f2c26c80973c81093db07c6022b2b30e", "status": "affected", "versionType": "git" }, { "version": "c433570458e49bccea5c551df628d058b3526289", "lessThan": "8937f5e38a218531dce2a89fae60e3adcc2311e1", "status": "affected", "versionType": "git" }, { "version": "c433570458e49bccea5c551df628d058b3526289", "lessThan": "c2531db6de3c95551be58878f859c6a053b7eb2e", "status": "affected", "versionType": "git" }, { "version": "c433570458e49bccea5c551df628d058b3526289", "lessThan": "95fc45d1dea8e1253f8ec58abc5befb71553d666", "status": "affected", "versionType": "git" }, { "version": "7f93d703e276311dd289c9a520ce9e8c8fa2858c", "status": "affected", "versionType": "git" }, { "version": "c0e93a6d36135d5082cb3af8352f5b69c9f58d6e", "status": "affected", "versionType": "git" }, { "version": "c39b8fd4997bf99503b8e48d8cb0eedb1d9a54f0", "status": "affected", "versionType": "git" }, { "version": "26a5adc8eb26d170058645c3cccd4d19165bec16", "status": "affected", "versionType": "git" }, { "version": "3e881d8764ed9b04ae3e5c3e5d132acb75ef91ba", "status": "affected", "versionType": "git" }, { "version": "77768c96dcf860c43b970b87b2a09229f84ea560", "status": "affected", "versionType": "git" }, { "version": "3.18.132", "lessThan": "3.19", "status": "affected", "versionType": "semver" }, { "version": "4.4.170", "lessThan": "4.5", "status": "affected", "versionType": "semver" }, { "version": "4.9.149", "lessThan": "4.10", "status": "affected", "versionType": "semver" }, { "version": "4.14.92", "lessThan": "4.15", "status": "affected", "versionType": "semver" }, { "version": "4.19.14", "lessThan": "4.20", "status": "affected", "versionType": "semver" }, { "version": "4.20.1", "lessThan": "4.21", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/netdevice.h", "include/net/ax25.h", "net/ax25/af_ax25.c", "net/ax25/ax25_dev.c", "net/ax25/ax25_ip.c", "net/ax25/ax25_out.c", "net/ax25/ax25_route.c" ], "versions": [ { "version": "5.0", "status": "affected" }, { "version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.129" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18.132" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.170" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.149" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.92" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2802ed4ced27ebd474828fc67ffd7d66f11e3605" }, { "url": "https://git.kernel.org/stable/c/7705d8a7f2c26c80973c81093db07c6022b2b30e" }, { "url": "https://git.kernel.org/stable/c/8937f5e38a218531dce2a89fae60e3adcc2311e1" }, { "url": "https://git.kernel.org/stable/c/c2531db6de3c95551be58878f859c6a053b7eb2e" }, { "url": "https://git.kernel.org/stable/c/95fc45d1dea8e1253f8ec58abc5befb71553d666" } ], "title": "ax25: rcu protect dev->ax25_ptr", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-21812", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-03-04T18:00:00.916644Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T18:07:17.248Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:59:48.635Z" } } ] } }