CVE-2025-21676: net: fec: handle page_pool_dev_alloc_pages error
In the Linux kernel, the following vulnerability has been resolved:
net: fec: handle pagepooldevallocpages error
The fecenetupdatecbd function calls pagepooldevallocpages but did not handle the case when it returned NULL. There was a WARNON(!newpage) but it would still proceed to use the NULL pointer and then crash.
This case does seem somewhat rare but when the system is under memory pressure it can happen. One case where I can duplicate this with some frequency is when writing over a smbd share to a SATA HDD attached to an imx6q.
Setting /proc/sys/vm/minfreekbytes to higher values also seems to solve the problem for my test case. But it still seems wrong that the fec driver ignores the memory allocation error and can crash.
This commit handles the allocation error by dropping the current packet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21676?
CVE-2025-21676 has not been assigned a severity rating, but it affects kernel functionality which can lead to potential denial of service.
How do I fix CVE-2025-21676?
To fix CVE-2025-21676, update your Linux kernel to the latest version that includes the patch addressing this vulnerability.
What causes CVE-2025-21676 in the Linux kernel?
CVE-2025-21676 is caused by an error handling oversight in the fec_enet_update_cbd function that does not properly handle a NULL return from page_pool_dev_alloc_pages.
Which versions of the Linux kernel are affected by CVE-2025-21676?
CVE-2025-21676 affects certain versions of the Linux kernel, specifically those using the fec_enet driver.
Is CVE-2025-21676 exploitable remotely?
CVE-2025-21676 is not known to be remotely exploitable but could be leveraged in systems with local access to cause issues.