GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21954 (GCVE-0-2025-21954)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:46 – Updated: 2026-08-05 11:55
VLAI
Title
netmem: prevent TX of unreadable skbs
Summary
In the Linux kernel, the following vulnerability has been resolved: netmem: prevent TX of unreadable skbs Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the device's TX path, as the device may call dma-mapping APIs on dma addrs that should not be passed to it. Fix this by preventing the xmit of unreadable skbs. Tested by configuring tc redirect: sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \ tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1 Before, I see unreadable skbs in the driver's TX path passed to dma mapping APIs. After, I don't see unreadable skbs in the driver's TX path passed to dma mapping APIs.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 65249feb6b3df9e17bab5911ee56fa7b0971e231 , < 454825019d2f0c59e5174ece9e713f45ad80beff (git)
Affected: 65249feb6b3df9e17bab5911ee56fa7b0971e231 , < 1c17c8ced25c5fbe424c7ad7ea11d33014a986b1 (git)
Affected: 65249feb6b3df9e17bab5911ee56fa7b0971e231 , < f3600c867c99a2cc8038680ecf211089c50e7971 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.20 , ≤ 6.12.* (semver)
Unaffected: 6.13.8 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "454825019d2f0c59e5174ece9e713f45ad80beff",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            },
            {
              "lessThan": "1c17c8ced25c5fbe424c7ad7ea11d33014a986b1",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            },
            {
              "lessThan": "f3600c867c99a2cc8038680ecf211089c50e7971",
              "status": "affected",
              "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetmem: prevent TX of unreadable skbs\n\nCurrently on stable trees we have support for netmem/devmem RX but not\nTX. It is not safe to forward/redirect an RX unreadable netmem packet\ninto the device\u0027s TX path, as the device may call dma-mapping APIs on\ndma addrs that should not be passed to it.\n\nFix this by preventing the xmit of unreadable skbs.\n\nTested by configuring tc redirect:\n\nsudo tc qdisc add dev eth1 ingress\nsudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \\\n\ttcp src_ip 192.168.1.12 action mirred egress redirect dev eth1\n\nBefore, I see unreadable skbs in the driver\u0027s TX path passed to dma\nmapping APIs.\n\nAfter, I don\u0027t see unreadable skbs in the driver\u0027s TX path passed to dma\nmapping APIs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The unreadable skb is created by the RX path from a packet sent by a remote peer into a dmabuf-bound RX queue, and the bug fires when that received packet is forwarded/bridged/redirected to egress (`ip_forward`/`br_forward`/`act_mirred` \u2192 `dev_queue_xmit` \u2192 `validate_xmit_skb`). The attacker\u0027s only action is transmitting network traffic to the host.\nAC:L - On a host in the affected configuration the trigger is fully deterministic \u2014 every forwarded devmem skb reaches `skb_frag_dma_map()` with a NULL page; there is no race window, timing dependency, or memory-layout requirement the attacker must win. `CONFIG_NET_DEVMEM` is `def_bool y`, and per CVSS the vulnerable runtime configuration is assumed rather than charged to complexity.\nPR:N - The remote sender needs no account, credential, or privilege on the target; ordinary unauthenticated packets landing on the devmem-bound queue and being forwarded are sufficient. The CAP_NET_ADMIN-gated `NETDEV_CMD_BIND_RX` is pre-existing admin setup, not something the attacker must perform.\nUI:N - No victim action is required \u2014 packet reception and kernel forwarding happen autonomously in softirq context. The devmem binding and forwarding/redirect rules are pre-existing system state, not an interaction solicited from a user.\nS:U - The bogus DMA mapping is programmed by the kernel itself and all consequences (crash, DMA fault, unintended memory access) land within the same host kernel\u0027s security authority. No guest/host, IOMMU-enforcement, or sandbox boundary is escaped by the vulnerability itself.\nC:H - The NIC is handed a DMA address derived from a NULL `struct page` that bears no relation to the intended buffer, so on the TX (device-read) path host memory outside any granted buffer can be fetched by the device and transmitted on the wire to the remote peer; the swiotlb path additionally `memcpy`s from `phys_to_virt()` of that garbage address into a bounce buffer that is then sent out.\nI:H - This is a DMA memory-safety violation: the kernel installs a mapping (and on IOMMU systems an active IOVA translation) for a physical range it never owned, and the subsequent `dma_sync`/`dma_unmap` and cache-maintenance operations act on that arbitrary physical range, so memory outside the intended buffer can be modified. Such device-DMA corruption is leveragable well beyond a simple crash.\nA:H - Outcomes include a kernel NULL dereference (`is_pci_p2pdma_page(NULL)`/`swiotlb_bounce()` on confidential-VM and bounce-buffer configurations), DMAR/AER fault storms and TX-ring wedging when the device aborts on the invalid address, and device reset or panic on platforms that escalate the PCIe error \u2014 all repeatable at will by continuing to send traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:34.681Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/454825019d2f0c59e5174ece9e713f45ad80beff"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c17c8ced25c5fbe424c7ad7ea11d33014a986b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3600c867c99a2cc8038680ecf211089c50e7971"
        }
      ],
      "title": "netmem: prevent TX of unreadable skbs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21954",
    "datePublished": "2025-04-01T15:46:55.226Z",
    "dateReserved": "2024-12-29T08:45:45.790Z",
    "dateUpdated": "2026-08-05T11:55:34.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21954",
      "date": "2026-09-20",
      "epss": "0.00483",
      "percentile": "0.40762"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "454825019d2f0c59e5174ece9e713f45ad80beff",
                    "status": "affected",
                    "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1c17c8ced25c5fbe424c7ad7ea11d33014a986b1",
                    "status": "affected",
                    "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f3600c867c99a2cc8038680ecf211089c50e7971",
                    "status": "affected",
                    "version": "65249feb6b3df9e17bab5911ee56fa7b0971e231",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.20",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F6AE02FC-5B2D-426A-B8D7-3D71FBE28D40",
                    "versionEndExcluding": "6.12.20",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0A20D4D7-B329-4C68-B662-76062EA7DCF0",
                    "versionEndExcluding": "6.13.8",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "45B90F6B-BEC7-4D4E-883A-9DBADE021750",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1759FFB7-531C-41B1-9AE1-FD3D80E0D920",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetmem: prevent TX of unreadable skbs\n\nCurrently on stable trees we have support for netmem/devmem RX but not\nTX. It is not safe to forward/redirect an RX unreadable netmem packet\ninto the device\u0027s TX path, as the device may call dma-mapping APIs on\ndma addrs that should not be passed to it.\n\nFix this by preventing the xmit of unreadable skbs.\n\nTested by configuring tc redirect:\n\nsudo tc qdisc add dev eth1 ingress\nsudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \\\n\ttcp src_ip 192.168.1.12 action mirred egress redirect dev eth1\n\nBefore, I see unreadable skbs in the driver\u0027s TX path passed to dma\nmapping APIs.\n\nAfter, I don\u0027t see unreadable skbs in the driver\u0027s TX path passed to dma\nmapping APIs."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netmem: evitar TX de skbs ilegibles Actualmente en \u00e1rboles estables tenemos soporte para netmem/devmem RX pero no TX. No es seguro reenviar/redirigir un paquete netmem ilegible RX en la ruta TX del dispositivo, ya que el dispositivo puede llamar a las API de mapeo DMA en direcciones DMA que no se le deben pasar. Arregle esto al evitar la xmit de skbs ilegibles. Probado al configurar tc redirect: sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \\ tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1 Antes, ve\u00eda skbs ilegibles en la ruta TX del controlador pasada a las API de mapeo DMA. Despu\u00e9s, no veo skbs ilegibles en la ruta TX del controlador pasada a las API de mapeo de DMA."
          }
        ],
        "id": "CVE-2025-21954",
        "lastModified": "2026-07-30T06:21:59.060",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-04-01T16:15:26.610",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1c17c8ced25c5fbe424c7ad7ea11d33014a986b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/454825019d2f0c59e5174ece9e713f45ad80beff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f3600c867c99a2cc8038680ecf211089c50e7971"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:12:48+00:00",
      "cve": "CVE-2025-21954",
      "id": "CVE-2025-21954",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netmem: prevent TX of unreadable skbs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21954.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:26:12Z",
      "cve": "CVE-2025-21954",
      "id": "CVE-2025-21954",
      "initial_release_date": "2025-04-04T02:58:41Z",
      "product_status:known_not_affected": "467",
      "product_status:recommended": "120",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21954",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21954.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.