CVE-2025-21961 (GCVE-0-2025-21961)
Vulnerability from cvelistv5
Published
2025-04-01 15:46
Modified
2025-10-01 17:15
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb(). bnxt_xdp_build_skb() passes incorrect truesize argument to xdp_update_skb_shared_info(). The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but the skb_shared_info was wiped by napi_build_skb() before. So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use it instead of getting skb_shared_info from xdp_get_shared_info_from_buff(). Splat looks like: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590 Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3 RIP: 0010:skb_try_coalesce+0x504/0x590 Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0x84/0x130 ? skb_try_coalesce+0x504/0x590 ? report_bug+0x18a/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? skb_try_coalesce+0x504/0x590 inet_frag_reasm_finish+0x11f/0x2e0 ip_defrag+0x37a/0x900 ip_local_deliver+0x51/0x120 ip_sublist_rcv_finish+0x64/0x70 ip_sublist_rcv+0x179/0x210 ip_list_rcv+0xf9/0x130 How to reproduce: <Node A> ip link set $interface1 xdp obj xdp_pass.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interfac2 mtu 9000 up ip a a 10.0.0.2/24 dev $interface2 ping 10.0.0.1 -s 65000 Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1dc4c557bfedfcdf7fc0c46795857773b7ad66e7
Version: 1dc4c557bfedfcdf7fc0c46795857773b7ad66e7
Version: 1dc4c557bfedfcdf7fc0c46795857773b7ad66e7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:15:46.557576Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:15:48.731Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c",
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19107e71be330dbccb9f8f9f4cf0a9abeadad802",
              "status": "affected",
              "version": "1dc4c557bfedfcdf7fc0c46795857773b7ad66e7",
              "versionType": "git"
            },
            {
              "lessThan": "b4679807c6083ade4d47f03f80da891afcb6ef62",
              "status": "affected",
              "version": "1dc4c557bfedfcdf7fc0c46795857773b7ad66e7",
              "versionType": "git"
            },
            {
              "lessThan": "9f7b2aa5034e24d3c49db73d5f760c0435fe31c2",
              "status": "affected",
              "version": "1dc4c557bfedfcdf7fc0c46795857773b7ad66e7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c",
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: fix truesize for mb-xdp-pass case\n\nWhen mb-xdp is set and return is XDP_PASS, packet is converted from\nxdp_buff to sk_buff with xdp_update_skb_shared_info() in\nbnxt_xdp_build_skb().\nbnxt_xdp_build_skb() passes incorrect truesize argument to\nxdp_update_skb_shared_info().\nThe truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo-\u003enr_frags but\nthe skb_shared_info was wiped by napi_build_skb() before.\nSo it stores sinfo-\u003enr_frags before bnxt_xdp_build_skb() and use it\ninstead of getting skb_shared_info from xdp_get_shared_info_from_buff().\n\nSplat looks like:\n ------------[ cut here ]------------\n WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590\n Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms\n CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3\n RIP: 0010:skb_try_coalesce+0x504/0x590\n Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff \u003c0f\u003e 0b e99\n RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287\n RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0\n RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003\n RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900\n R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740\n R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002\n FS:  0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0\n PKRU: 55555554\n Call Trace:\n  \u003cIRQ\u003e\n  ? __warn+0x84/0x130\n  ? skb_try_coalesce+0x504/0x590\n  ? report_bug+0x18a/0x1a0\n  ? handle_bug+0x53/0x90\n  ? exc_invalid_op+0x14/0x70\n  ? asm_exc_invalid_op+0x16/0x20\n  ? skb_try_coalesce+0x504/0x590\n  inet_frag_reasm_finish+0x11f/0x2e0\n  ip_defrag+0x37a/0x900\n  ip_local_deliver+0x51/0x120\n  ip_sublist_rcv_finish+0x64/0x70\n  ip_sublist_rcv+0x179/0x210\n  ip_list_rcv+0xf9/0x130\n\nHow to reproduce:\n\u003cNode A\u003e\nip link set $interface1 xdp obj xdp_pass.o\nip link set $interface1 mtu 9000 up\nip a a 10.0.0.1/24 dev $interface1\n\u003cNode B\u003e\nip link set $interfac2 mtu 9000 up\nip a a 10.0.0.2/24 dev $interface2\nping 10.0.0.1 -s 65000\n\nFollowing ping.py patch adds xdp-mb-pass case. so ping.py is going to be\nable to reproduce this issue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:25:50.120Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19107e71be330dbccb9f8f9f4cf0a9abeadad802"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4679807c6083ade4d47f03f80da891afcb6ef62"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f7b2aa5034e24d3c49db73d5f760c0435fe31c2"
        }
      ],
      "title": "eth: bnxt: fix truesize for mb-xdp-pass case",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21961",
    "datePublished": "2025-04-01T15:46:58.795Z",
    "dateReserved": "2024-12-29T08:45:45.795Z",
    "dateUpdated": "2025-10-01T17:15:48.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21961\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:27.343\",\"lastModified\":\"2025-10-01T18:15:40.500\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\neth: bnxt: fix truesize for mb-xdp-pass case\\n\\nWhen mb-xdp is set and return is XDP_PASS, packet is converted from\\nxdp_buff to sk_buff with xdp_update_skb_shared_info() in\\nbnxt_xdp_build_skb().\\nbnxt_xdp_build_skb() passes incorrect truesize argument to\\nxdp_update_skb_shared_info().\\nThe truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo-\u003enr_frags but\\nthe skb_shared_info was wiped by napi_build_skb() before.\\nSo it stores sinfo-\u003enr_frags before bnxt_xdp_build_skb() and use it\\ninstead of getting skb_shared_info from xdp_get_shared_info_from_buff().\\n\\nSplat looks like:\\n ------------[ cut here ]------------\\n WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590\\n Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms\\n CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3\\n RIP: 0010:skb_try_coalesce+0x504/0x590\\n Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff \u003c0f\u003e 0b e99\\n RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287\\n RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0\\n RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003\\n RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900\\n R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740\\n R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002\\n FS:  0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0\\n PKRU: 55555554\\n Call Trace:\\n  \u003cIRQ\u003e\\n  ? __warn+0x84/0x130\\n  ? skb_try_coalesce+0x504/0x590\\n  ? report_bug+0x18a/0x1a0\\n  ? handle_bug+0x53/0x90\\n  ? exc_invalid_op+0x14/0x70\\n  ? asm_exc_invalid_op+0x16/0x20\\n  ? skb_try_coalesce+0x504/0x590\\n  inet_frag_reasm_finish+0x11f/0x2e0\\n  ip_defrag+0x37a/0x900\\n  ip_local_deliver+0x51/0x120\\n  ip_sublist_rcv_finish+0x64/0x70\\n  ip_sublist_rcv+0x179/0x210\\n  ip_list_rcv+0xf9/0x130\\n\\nHow to reproduce:\\n\u003cNode A\u003e\\nip link set $interface1 xdp obj xdp_pass.o\\nip link set $interface1 mtu 9000 up\\nip a a 10.0.0.1/24 dev $interface1\\n\u003cNode B\u003e\\nip link set $interfac2 mtu 9000 up\\nip a a 10.0.0.2/24 dev $interface2\\nping 10.0.0.1 -s 65000\\n\\nFollowing ping.py patch adds xdp-mb-pass case. so ping.py is going to be\\nable to reproduce this issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: eth: bnxt: correcci\u00f3n de truesize para el caso mb-xdp-pass. Cuando mb-xdp est\u00e1 configurado y el valor de retorno es XDP_PASS, el paquete se convierte de xdp_buff a sk_buff con xdp_update_skb_shared_info() en bnxt_xdp_build_skb(). bnxt_xdp_build_skb() pasa un argumento truesize incorrecto a xdp_update_skb_shared_info(). El truesize se calcula como BNXT_RX_PAGE_SIZE * sinfo-\u0026gt;nr_frags, pero napi_build_skb() borr\u00f3 previamente skb_shared_info. De este modo, almacena sinfo-\u0026gt;nr_frags antes de bnxt_xdp_build_skb() y lo utiliza en lugar de obtener skb_shared_info de xdp_get_shared_info_from_buff(). El splat se ve as\u00ed: ------------[ cortar aqu\u00ed ]------------ ADVERTENCIA: CPU: 2 PID: 0 en net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590 M\u00f3dulos enlazados en: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 No contaminado 6.14.0-rc2+ #3 RIP: 0010:skb_try_coalesce+0x504/0x590 C\u00f3digo: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff \u0026lt;0f\u0026gt; 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 000000000000002 R15: 0000000000000002 FS: 000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Rastreo de llamadas:  ? __warn+0x84/0x130 ? skb_try_coalesce+0x504/0x590 ? report_bug+0x18a/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? skb_try_coalesce+0x504/0x590 inet_frag_reasm_finish+0x11f/0x2e0 ip_defrag+0x37a/0x900 ip_local_deliver+0x51/0x120 ip_sublist_rcv_finish+0x64/0x70 ip_sublist_rcv+0x179/0x210 ip_list_rcv+0xf9/0x130 C\u00f3mo reproducir:  enlace ip establecido $interfaz1 xdp obj xdp_pass.o enlace ip establecido $interfaz1 mtu 9000 activo ip aa 10.0.0.1/24 dev $interfaz1  enlace ip establecido $interfaz2 mtu 9000 activo ip aa 10.0.0.2/24 El siguiente parche de ping.py agrega el caso xdp-mb-pass, por lo que ping.py podr\u00e1 reproducir este problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.12.20\",\"matchCriteriaId\":\"B1170862-E3A2-4452-B8A3-EB09329034E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.8\",\"matchCriteriaId\":\"0A20D4D7-B329-4C68-B662-76062EA7DCF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1759FFB7-531C-41B1-9AE1-FD3D80E0D920\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/19107e71be330dbccb9f8f9f4cf0a9abeadad802\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9f7b2aa5034e24d3c49db73d5f760c0435fe31c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4679807c6083ade4d47f03f80da891afcb6ef62\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:25:50.120Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\neth: bnxt: fix truesize for mb-xdp-pass case\\n\\nWhen mb-xdp is set and return is XDP_PASS, packet is converted from\\nxdp_buff to sk_buff with xdp_update_skb_shared_info() in\\nbnxt_xdp_build_skb().\\nbnxt_xdp_build_skb() passes incorrect truesize argument to\\nxdp_update_skb_shared_info().\\nThe truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo-\u003enr_frags but\\nthe skb_shared_info was wiped by napi_build_skb() before.\\nSo it stores sinfo-\u003enr_frags before bnxt_xdp_build_skb() and use it\\ninstead of getting skb_shared_info from xdp_get_shared_info_from_buff().\\n\\nSplat looks like:\\n ------------[ cut here ]------------\\n WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590\\n Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms\\n CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3\\n RIP: 0010:skb_try_coalesce+0x504/0x590\\n Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff \u003c0f\u003e 0b e99\\n RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287\\n RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0\\n RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003\\n RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900\\n R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740\\n R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002\\n FS:  0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0\\n PKRU: 55555554\\n Call Trace:\\n  \u003cIRQ\u003e\\n  ? __warn+0x84/0x130\\n  ? skb_try_coalesce+0x504/0x590\\n  ? report_bug+0x18a/0x1a0\\n  ? handle_bug+0x53/0x90\\n  ? exc_invalid_op+0x14/0x70\\n  ? asm_exc_invalid_op+0x16/0x20\\n  ? skb_try_coalesce+0x504/0x590\\n  inet_frag_reasm_finish+0x11f/0x2e0\\n  ip_defrag+0x37a/0x900\\n  ip_local_deliver+0x51/0x120\\n  ip_sublist_rcv_finish+0x64/0x70\\n  ip_sublist_rcv+0x179/0x210\\n  ip_list_rcv+0xf9/0x130\\n\\nHow to reproduce:\\n\u003cNode A\u003e\\nip link set $interface1 xdp obj xdp_pass.o\\nip link set $interface1 mtu 9000 up\\nip a a 10.0.0.1/24 dev $interface1\\n\u003cNode B\u003e\\nip link set $interfac2 mtu 9000 up\\nip a a 10.0.0.2/24 dev $interface2\\nping 10.0.0.1 -s 65000\\n\\nFollowing ping.py patch adds xdp-mb-pass case. so ping.py is going to be\\nable to reproduce this issue.\"}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\", \"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"], \"versions\": [{\"version\": \"1dc4c557bfedfcdf7fc0c46795857773b7ad66e7\", \"lessThan\": \"19107e71be330dbccb9f8f9f4cf0a9abeadad802\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"1dc4c557bfedfcdf7fc0c46795857773b7ad66e7\", \"lessThan\": \"b4679807c6083ade4d47f03f80da891afcb6ef62\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"1dc4c557bfedfcdf7fc0c46795857773b7ad66e7\", \"lessThan\": \"9f7b2aa5034e24d3c49db73d5f760c0435fe31c2\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\", \"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"], \"versions\": [{\"version\": \"5.19\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"5.19\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.12.20\", \"lessThanOrEqual\": \"6.12.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.13.8\", \"lessThanOrEqual\": \"6.13.*\", \"status\": \"unaffected\", \"versionType\": \"semver\"}, {\"version\": \"6.14\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.19\", \"versionEndExcluding\": \"6.12.20\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.19\", \"versionEndExcluding\": \"6.13.8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.19\", \"versionEndExcluding\": \"6.14\"}]}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/19107e71be330dbccb9f8f9f4cf0a9abeadad802\"}, {\"url\": \"https://git.kernel.org/stable/c/b4679807c6083ade4d47f03f80da891afcb6ef62\"}, {\"url\": \"https://git.kernel.org/stable/c/9f7b2aa5034e24d3c49db73d5f760c0435fe31c2\"}], \"title\": \"eth: bnxt: fix truesize for mb-xdp-pass case\", \"x_generator\": {\"engine\": \"bippy-1.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21961\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T17:15:46.557576Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T14:38:29.384Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21961\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2024-12-29T08:45:45.795Z\", \"datePublished\": \"2025-04-01T15:46:58.795Z\", \"dateUpdated\": \"2025-10-01T17:15:48.731Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.