CVE-2025-21669: vsock/virtio: discard packets if the transport changes
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: discard packets if the transport changes
If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected and would cause issues when we access vsk->transport.
A possible scenario is described by Hyunwoo Kim in the attached link, where after a first connect() interrupted by a signal, and a second connect() failed, we can find vsk->transport at NULL, leading to a NULL pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.180.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.76.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21669?
The severity of CVE-2025-21669 has not been explicitly defined but it addresses a critical issue related to socket management in the Linux kernel.
How do I fix CVE-2025-21669?
To fix CVE-2025-21669, update your Linux kernel to a version higher than 5.15.177, 6.1.127, 6.6.74, 6.12.11, or any 6.13 release candidate.
Which versions of the Linux kernel are affected by CVE-2025-21669?
CVE-2025-21669 affects Linux kernel versions between 5.5 and 5.15.177, 5.16 and 6.1.127, 6.2 and 6.6.74, 6.7 and 6.12.11, as well as various release candidates of 6.13.
What type of vulnerability is CVE-2025-21669?
CVE-2025-21669 is a network vulnerability related to the handling of vsock/virtio packets in the Linux kernel.
What consequences could arise if CVE-2025-21669 is exploited?
Exploitation of CVE-2025-21669 could lead to unexpected behavior and issues in packet handling due to mishandled socket assignments.