CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode
In the Linux kernel, the following vulnerability has been resolved:
net: xdp: Disallow attaching device-bound programs in generic mode
Device-bound programs are used to support RX metadata kfuncs. These kfuncs are driver-specific and rely on the driver context to read the metadata. This means they can't work in generic XDP mode. However, there is no check to disallow such programs from being attached in generic mode, in which case the metadata kfuncs will be called in an invalid context, leading to crashes.
Fix this by adding a check to disallow attaching device-bound programs in generic mode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add/ensure the kernel check that disallows attaching device-bound programs when running in generic XDP mode (so device-bound metadata kfuncs are not called in generic mode and cannot crash).
Linux kernel net: xdp Disallow attaching device-bound programs in generic mode = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21808?
CVE-2025-21808 has been classified as having a moderate severity level.
How do I fix CVE-2025-21808?
To mitigate CVE-2025-21808, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What systems are affected by CVE-2025-21808?
CVE-2025-21808 affects the Linux kernel, particularly those with device-bound programs using RX metadata kfuncs.
What is the impact of CVE-2025-21808?
The impact of CVE-2025-21808 may include vulnerabilities related to the execution of device-bound programs and potential exploitation in generic mode.
When was CVE-2025-21808 announced?
CVE-2025-21808 was announced in 2025 as part of ongoing updates to the Linux kernel security measures.