CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace
First published: Tue Jan 21 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock. napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id().
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-21659?
CVE-2025-21659 has a severity rating that should be assessed based on the specifics of the impacted Linux kernel version.
How do I fix CVE-2025-21659?
To resolve CVE-2025-21659, update your Linux kernel to the latest version where the vulnerability has been patched.
What causes CVE-2025-21659 in the Linux kernel?
CVE-2025-21659 is caused by improper handling of NAPI instances across different namespaces in the Linux kernel.
Who is affected by CVE-2025-21659?
Anyone using affected versions of the Linux kernel that do not prevent namespace interference with NAPI instances is at risk from CVE-2025-21659.
What are the potential impacts of CVE-2025-21659?
The potential impacts of CVE-2025-21659 could include system instability and security risks related to network processing.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/first-publish-date
- agent/description
- agent/type
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux kernel