CVE-2025-21883: ice: Fix deinitializing VF in error path
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix deinitializing VF in error path
If iceenavfs() fails after calling icecreatevfentries(), it frees all VFs without removing them from snapshot PF-VF mailbox list, leading to list corruption.
Reproducer: devlink dev eswitch set $PF1PCI mode switchdev ip l s $PF1 up ip l s $PF1 promisc on sleep 1 echo 1 > /sys/class/net/$PF1/device/sriovnumvfs sleep 1 echo 1 > /sys/class/net/$PF1/device/sriovnumvfs
Trace (minimized): listadd corruption. next->prev should be prev (ffff8882e241c6f0), but was 0000000000000000. (next=ffff888455da1330). kernel BUG at lib/listdebug.c:29! RIP: 0010:listaddvalidorreport+0xa6/0x100 icembxinitvfinfo+0xa7/0x180 [ice] iceinitializevfentry+0x1fa/0x250 [ice] icesriovconfigure+0x8d7/0x1520 [ice] ? percpurefswitchmode+0x1b1/0x5d0 ? pfxicesriovconfigure+0x10/0x10 [ice]
Sometimes a KASAN report can be seen instead with a similar stack trace: BUG: KASAN: use-after-free in listaddvalidorreport+0xf1/0x100
VFs are added to this list in icembxinitvfinfo(), but only removed in icefreevfs(). Move the removing to icefreevfentries(), which is also being called in other places where VFs are being removed (including icefreevfs() itself).
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix deinitializing VF in error path
If iceenavfs() fails after calling icecreatevfentries(), it frees all VFs without removing them from snapshot PF-VF mailbox list, leading to list corruption.
Reproducer: devlink dev eswitch set $PF1PCI mode switchdev ip l s $PF1 up ip l s $PF1 promisc on sleep 1 echo 1 > /sys/class/net/$PF1/device/sriovnumvfs sleep 1 echo 1 > /sys/class/net/$PF1/device/sriovnumvfs
Trace (minimized): listadd corruption. next->prev should be prev (ffff8882e241c6f0), but was 0000000000000000. (next=ffff888455da1330). kernel BUG at lib/listdebug.c:29! RIP: 0010:listaddvalidorreport+0xa6/0x100 icembxinitvfinfo+0xa7/0x180 [ice] iceinitializevfentry+0x1fa/0x250 [ice] icesriovconfigure+0x8d7/0x1520 [ice] ? percpurefswitchmode+0x1b1/0x5d0 ? pfxicesriovconfigure+0x10/0x10 [ice]
Sometimes a KASAN report can be seen instead with a similar stack trace: BUG: KASAN: use-after-free in listaddvalidorreport+0xf1/0x100
VFs are added to this list in icembxinitvfinfo(), but only removed in icefreevfs(). Move the removing to icefreevfentries(), which is also being called in other places where VFs are being removed (including icefreevfs() itself).
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21883?
CVE-2025-21883 has a moderate severity level due to its potential for disrupting virtual function operations in the Linux kernel.
How do I fix CVE-2025-21883?
Fix CVE-2025-21883 by updating the Linux kernel to the latest version that contains the patch for this vulnerability.
What components are affected by CVE-2025-21883?
CVE-2025-21883 affects the ice driver in the Linux kernel, particularly in configurations utilizing virtual functions.
Is exploitation of CVE-2025-21883 easy?
Exploitation of CVE-2025-21883 requires a specific setup and occurs in scenarios where errors are mishandled during virtual function initialization.
What are the consequences of CVE-2025-21883 if exploited?
If CVE-2025-21883 is exploited, it could lead to system instability and possible data corruption due to list corruption in the PF-VF mailbox.