CVE-2025-21666: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
First published: Fri Jan 31 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Recent reports have shown how we sometimes call vsock_*_has_data() when a vsock socket has been de-assigned from a transport (see attached links), but we shouldn't. Previous commits should have solved the real problems, but we may have more in the future, so to avoid null-ptr-deref, we can return 0 (no space, no data available) but with a warning. This way the code should continue to run in a nearly consistent state and have a warning that allows us to debug future problems.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | >=5.5<5.15.177 | |
| Linux Kernel | >=5.16<6.1.127 | |
| Linux Kernel | >=6.2<6.6.74 | |
| Linux Kernel | >=6.7<6.12.11 | |
| Linux Kernel | =6.13-rc1 | |
| Linux Kernel | =6.13-rc2 | |
| Linux Kernel | =6.13-rc3 | |
| Linux Kernel | =6.13-rc4 | |
| Linux Kernel | =6.13-rc5 | |
| Linux Kernel | =6.13-rc6 | |
| Linux Kernel | =6.13-rc7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/daeac89cdb03d30028186f5ff7dc26ec8fa843e7
- https://git.kernel.org/stable/c/9e5fed46ccd2c34c5fa5a9c8825ce4823fdc853e
- https://git.kernel.org/stable/c/b52e50dd4fabd12944172bd486a4f4853b7f74dd
- https://git.kernel.org/stable/c/bc9c49341f9728c31fe248c5fbba32d2e81a092b
- https://git.kernel.org/stable/c/c23d1d4f8efefb72258e9cedce29de10d057f8ca
- https://git.kernel.org/stable/c/91751e248256efc111e52e15115840c35d85abaf
Frequently Asked Questions
What is the severity of CVE-2025-21666?
CVE-2025-21666 is classified as a moderate severity vulnerability.
How do I fix CVE-2025-21666?
To fix CVE-2025-21666, you should update your Linux kernel to the latest stable version that resolves this issue.
Which versions of the Linux kernel are affected by CVE-2025-21666?
CVE-2025-21666 affects Linux kernel versions from 5.5 up to 6.13-rc7.
What kind of issue does CVE-2025-21666 address?
CVE-2025-21666 addresses a null pointer dereference in the vsock_*[has_data|has_space] functions.
Is exploitation of CVE-2025-21666 possible remotely?
Exploitation of CVE-2025-21666 typically requires local access to the affected system.
- agent/type
- agent/description
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/source
- agent/title
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/remedy
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.5
- version/linux kernel/5.16
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.13-rc1
- version/linux kernel/6.13-rc2
- version/linux kernel/6.13-rc3
- version/linux kernel/6.13-rc4
- version/linux kernel/6.13-rc5
- version/linux kernel/6.13-rc6
- version/linux kernel/6.13-rc7