CVE-2025-21868: net: allow small head cache usage with large MAX_SKB_FRAGS values
In the Linux kernel, the following vulnerability has been resolved:
net: allow small head cache usage with large MAXSKBFRAGS values
Sabrina reported the following splat:
WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netifnapiaddweightlocked+0x8f2/0xba0 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:netifnapiaddweightlocked+0x8f2/0xba0 Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe <0f> 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48 RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6 RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168 R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007 FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> grocellsinit+0x1ba/0x270 xfrminputinit+0x4b/0x2a0 xfrminit+0x38/0x50 iprtinit+0x2d7/0x350 ipinit+0xf/0x20 inetinit+0x406/0x590 dooneinitcall+0x9d/0x2e0 doinitcalls+0x23b/0x280 kernelinitfreeable+0x445/0x490 kernelinit+0x20/0x1d0 retfromfork+0x46/0x80 retfromforkasm+0x1a/0x30 </TASK> irq event stamp: 584330 hardirqs last enabled at (584338): [<ffffffff8168bf87>] upconsolesem+0x77/0xb0 hardirqs last disabled at (584345): [<ffffffff8168bf6c>] upconsolesem+0x5c/0xb0 softirqs last enabled at (583242): [<ffffffff833ee96d>] netlinkinsert+0x14d/0x470 softirqs last disabled at (583754): [<ffffffff8317c8cd>] netifnapiaddweightlocked+0x77d/0xba0
on kernel built with MAXSKBFRAGS=45, where SKBWITHOVERHEAD(1024) is smaller than GROMAXHEAD.
Such built additionally contains the revert of the single page frag cache so that napigetfrags() ends up using the page frag allocator, triggering the splat.
Note that the underlying issue is independent from the mentioned revert; address it ensuring that the small head cache will fit either TCP and GRO allocation and updating napiallocskb() and netdevallocskb() to select kmalloc() usage for any allocation fitting such cache.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21868?
The severity of CVE-2025-21868 is classified as moderate, as it can lead to potential instability within the Linux kernel under specific conditions.
How do I fix CVE-2025-21868?
To fix CVE-2025-21868, update your Linux kernel to the latest version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-21868?
CVE-2025-21868 affects various versions of the Linux kernel that do not include the patches addressing the specific vulnerability.
Can CVE-2025-21868 lead to data loss?
While CVE-2025-21868 does not directly cause data loss, it may result in system instabilities that could affect data integrity.
Is CVE-2025-21868 remotely exploitable?
CVE-2025-21868 is not considered remotely exploitable, as it primarily affects the kernel under particular conditions requiring local access.