{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-21868",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2024-12-29T08:45:45.781Z",
        "datePublished": "2025-03-27T13:38:21.586Z",
        "dateUpdated": "2026-08-05T11:55:00.388Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T11:55:00.388Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: allow small head cache usage with large MAX_SKB_FRAGS values\n\nSabrina reported the following splat:\n\n    WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0\n    Modules linked in:\n    CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\n    RIP: 0010:netif_napi_add_weight_locked+0x8f2/0xba0\n    Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe <0f> 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48\n    RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293\n    RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e\n    RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6\n    RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c\n    R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168\n    R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007\n    FS:  0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n    Call Trace:\n    <TASK>\n    gro_cells_init+0x1ba/0x270\n    xfrm_input_init+0x4b/0x2a0\n    xfrm_init+0x38/0x50\n    ip_rt_init+0x2d7/0x350\n    ip_init+0xf/0x20\n    inet_init+0x406/0x590\n    do_one_initcall+0x9d/0x2e0\n    do_initcalls+0x23b/0x280\n    kernel_init_freeable+0x445/0x490\n    kernel_init+0x20/0x1d0\n    ret_from_fork+0x46/0x80\n    ret_from_fork_asm+0x1a/0x30\n    </TASK>\n    irq event stamp: 584330\n    hardirqs last  enabled at (584338): [<ffffffff8168bf87>] __up_console_sem+0x77/0xb0\n    hardirqs last disabled at (584345): [<ffffffff8168bf6c>] __up_console_sem+0x5c/0xb0\n    softirqs last  enabled at (583242): [<ffffffff833ee96d>] netlink_insert+0x14d/0x470\n    softirqs last disabled at (583754): [<ffffffff8317c8cd>] netif_napi_add_weight_locked+0x77d/0xba0\n\non kernel built with MAX_SKB_FRAGS=45, where SKB_WITH_OVERHEAD(1024)\nis smaller than GRO_MAX_HEAD.\n\nSuch built additionally contains the revert of the single page frag cache\nso that napi_get_frags() ends up using the page frag allocator, triggering\nthe splat.\n\nNote that the underlying issue is independent from the mentioned\nrevert; address it ensuring that the small head cache will fit either TCP\nand GRO allocation and updating napi_alloc_skb() and __netdev_alloc_skb()\nto select kmalloc() usage for any allocation fitting such cache."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                        "baseScore": 7.5,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:N - The defective allocation path is `napi_alloc_skb(napi, GRO_MAX_HEAD)` inside `napi_get_frags()`, driven entirely by inbound packets processed by NAPI/GRO in drivers such as gve, mlx4, ionic, sfc, cxgb4 and tun. A remote peer sending traffic to the host reaches it with no local access.\nAC:L - On an affected build the mis-selection is deterministic — every GRO head allocation takes the page-frag path, with no race, timing window, or memory-layout dependency — and the attacker only needs to send small packets and drain the socket slowly to pin pages. Per CVSS 3.1 §3.6 the non-default `CONFIG_MAX_SKB_FRAGS` value is scored as the assumed vulnerable configuration rather than as attack complexity.\nPR:N - The RX/GRO allocation path runs before any socket-level authentication or authorization; unsolicited packets from an unauthenticated remote host are enough to drive it. No credentials on the target are required.\nUI:N - Packet reception and GRO processing happen automatically in softirq context. No victim action of any kind is needed.\nS:U - The over-consumed memory and the failed accounting both belong to the kernel's own networking subsystem; no security authority boundary such as a VM, IOMMU, or sandbox is crossed.\nC:N - The bug only changes which allocator backs `skb->head`; buffers are still correctly sized and bounded, so no out-of-bounds read or kernel memory disclosure occurs.\nI:N - There is no out-of-bounds write, use-after-free, or type confusion — allocation sizes remain correct and freeing is consistently routed through `skb_free_frag()` for `head_frag` skbs, so no attacker-controlled data modification is possible.\nA:H - Each ~1.1 KB GRO head pins a slice of a 32 KB order-3 page while reporting a truesize ~23x smaller, so `tcp_mem`, `sk_rmem_alloc` and cgroup socket-memory limits are bypassed and sustained remote small-packet traffic drives the host into memory exhaustion and OOM — the exact production failure documented in the regressed commit 3226b158e67c. On non-4K-page builds the same condition additionally trips the `WARN_ON_ONCE` in `netif_napi_add_weight_locked()`, which is a boot-time panic under `panic_on_warn`."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "include/net/gro.h",
                        "net/core/gro.c",
                        "net/core/skbuff.c"
                    ],
                    "versions": [
                        {
                            "version": "3948b05950fdd64002a5f182c65ba5cf2d53cf71",
                            "lessThan": "ed8a77fee4618facd2a539cad7b7366697b5a575",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "3948b05950fdd64002a5f182c65ba5cf2d53cf71",
                            "lessThan": "ed0ca7d2127c63991cfaf1932b827e3f4f8ee480",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "3948b05950fdd64002a5f182c65ba5cf2d53cf71",
                            "lessThan": "648e440c98e260dec835e48a5d7a9993477b1f9d",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "3948b05950fdd64002a5f182c65ba5cf2d53cf71",
                            "lessThan": "14ad6ed30a10afbe91b0749d6378285f4225d482",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "include/net/gro.h",
                        "net/core/gro.c",
                        "net/core/skbuff.c"
                    ],
                    "versions": [
                        {
                            "version": "6.4",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.4",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.117",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.17",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.13.5",
                            "lessThanOrEqual": "6.13.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.14",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.4",
                                    "versionEndExcluding": "6.6.117"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.4",
                                    "versionEndExcluding": "6.12.17"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.4",
                                    "versionEndExcluding": "6.13.5"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.4",
                                    "versionEndExcluding": "6.14"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/ed8a77fee4618facd2a539cad7b7366697b5a575"
                },
                {
                    "url": "https://git.kernel.org/stable/c/ed0ca7d2127c63991cfaf1932b827e3f4f8ee480"
                },
                {
                    "url": "https://git.kernel.org/stable/c/648e440c98e260dec835e48a5d7a9993477b1f9d"
                },
                {
                    "url": "https://git.kernel.org/stable/c/14ad6ed30a10afbe91b0749d6378285f4225d482"
                }
            ],
            "title": "net: allow small head cache usage with large MAX_SKB_FRAGS values",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}