CVE-2025-21781: batman-adv: fix panic during interface removal
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix panic during interface removal
Reference counting is used to ensure that batadvhardifneighnode and batadvhardiface are not freed before/during batadvvelpthroughputmetricupdate work is finished.
But there isn't a guarantee that the hard if will remain associated with a soft interface up until the work is finished.
This fixes a crash triggered by reboot that looks like this:
Call trace: batadvvmeshfree+0xd0/0x4dc [batmanadv] batadvvelpthroughputmetricupdate+0x1c/0xa4 processonework+0x178/0x398 workerthread+0x2e8/0x4d0 kthread+0xd8/0xdc retfromfork+0x10/0x20
(the batadvvmeshfree call is misleading, and does not actually happen)
I was able to make the issue happen more reliably by changing hardifneigh->batv.metricwork work to be delayed work. This allowed me to track down and confirm the fix.
[sven@narfation.org: prevent entering batadvvelpgetthroughput without softiface]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21781?
CVE-2025-21781 is classified as a medium severity vulnerability.
How do I fix CVE-2025-21781?
To fix CVE-2025-21781, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2025-21781?
CVE-2025-21781 affects multiple versions of the Linux kernel and the batman-adv module.
What are the risks associated with CVE-2025-21781?
Exploitation of CVE-2025-21781 could potentially lead to system crashes or denial of service.
Is CVE-2025-21781 related to network performance issues?
Yes, CVE-2025-21781 specifically addresses a panic during interface removal, which can impact network performance.