CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
In the Linux kernel, the following vulnerability has been resolved:
bpf, testrun: Fix use-after-free issue in ethskbpkttype()
KMSAN reported a use-after-free issue in ethskbpkttype()[1]. The cause of the issue was that ethskbpkttype() accessed skb's data that didn't contain an Ethernet header. This occurs when bpfprogtestrunxdp() passes an invalid value as the userdata argument to bpftestinit().
Fix this by returning an error when userdata is less than ETHHLEN in bpftestinit(). Additionally, remove the check for "if (usersize > size)" as it is unnecessary.
[1] BUG: KMSAN: use-after-free in ethskbpkttype include/linux/etherdevice.h:627 [inline] BUG: KMSAN: use-after-free in ethtypetrans+0x4ee/0x980 net/ethernet/eth.c:165 ethskbpkttype include/linux/etherdevice.h:627 [inline] ethtypetrans+0x4ee/0x980 net/ethernet/eth.c:165 xdpbuildskbfromframe+0x5a8/0xa50 net/core/xdp.c:635 xdprecvframes net/bpf/testrun.c:272 [inline] xdptestrunbatch net/bpf/testrun.c:361 [inline] bpftestrunxdplive+0x2954/0x3330 net/bpf/testrun.c:390 bpfprogtestrunxdp+0x148e/0x1b10 net/bpf/testrun.c:1318 bpfprogtestrun+0x5b7/0xa30 kernel/bpf/syscall.c:4371 sysbpf+0x6a6/0xe20 kernel/bpf/syscall.c:5777 dosysbpf kernel/bpf/syscall.c:5866 [inline] sesysbpf kernel/bpf/syscall.c:5864 [inline] x64sysbpf+0xa4/0xf0 kernel/bpf/syscall.c:5864 x64syscall+0x2ea0/0x3d90 arch/x86/include/generated/asm/syscalls64.h:322 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xd9/0x1d0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
Uninit was created at: freepagesprepare mm/pagealloc.c:1056 [inline] freeunrefpage+0x156/0x1320 mm/pagealloc.c:2657 freepages+0xa3/0x1b0 mm/pagealloc.c:4838 bpfringbuffree kernel/bpf/ringbuf.c:226 [inline] ringbufmapfree+0xff/0x1e0 kernel/bpf/ringbuf.c:235 bpfmapfree kernel/bpf/syscall.c:838 [inline] bpfmapfreedeferred+0x17c/0x310 kernel/bpf/syscall.c:862 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xa2b/0x1b60 kernel/workqueue.c:3310 workerthread+0xedf/0x1550 kernel/workqueue.c:3391 kthread+0x535/0x6b0 kernel/kthread.c:389 retfromfork+0x6e/0x90 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:244
CPU: 1 UID: 0 PID: 17276 Comm: syz.1.16450 Not tainted 6.12.0-05490-g9bb88c659673 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.12.0-05490-g9bb88c659673Patch bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() - Configuration
In eth_skb_pkt_type() (include/linux/etherdevice.h:627), remove the unnecessary check for "if (user_size > size)" and instead add/ensure an explicit error return when user_data is less than ETH_HLEN, so eth_type_trans()/eth_skb_pkt_type() does not access skb data when no Ethernet header is present.
eth_skb_pkt_type() (include/linux/etherdevice.h) user_data length validation = return an error when user_data is less than ETH_HLEN
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21867?
CVE-2025-21867 has been classified with a severity level that indicates potential risks associated with use-after-free vulnerabilities in the Linux kernel.
How do I fix CVE-2025-21867?
To address CVE-2025-21867, update your Linux kernel to the latest version where this vulnerability has been patched.
What is the impact of CVE-2025-21867?
CVE-2025-21867 can lead to undefined behavior in the kernel, potentially allowing attackers to exploit memory corruption vulnerabilities.
What systems are affected by CVE-2025-21867?
CVE-2025-21867 affects all versions of the Linux kernel prior to the patched versions released following the identification of the vulnerability.
Is CVE-2025-21867 being actively exploited?
As of the current information, there is no indication that CVE-2025-21867 is actively being exploited in the wild.