CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace
In the Linux kernel, the following vulnerability has been resolved:
netdev: prevent accessing NAPI instances from another namespace
The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock.
napibyid() can become static now, but it needs to move because of devgetbynapiid().
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21659?
CVE-2025-21659 has a severity rating that should be assessed based on the specifics of the impacted Linux kernel version.
How do I fix CVE-2025-21659?
To resolve CVE-2025-21659, update your Linux kernel to the latest version where the vulnerability has been patched.
What causes CVE-2025-21659 in the Linux kernel?
CVE-2025-21659 is caused by improper handling of NAPI instances across different namespaces in the Linux kernel.
Who is affected by CVE-2025-21659?
Anyone using affected versions of the Linux kernel that do not prevent namespace interference with NAPI instances is at risk from CVE-2025-21659.
What are the potential impacts of CVE-2025-21659?
The potential impacts of CVE-2025-21659 could include system instability and security risks related to network processing.