CVE-2025-21891: ipvlan: ensure network headers are in skb linear part
In the Linux kernel, the following vulnerability has been resolved:
ipvlan: ensure network headers are in skb linear part
syzbot found that ipvlanprocessv6outbound() was assuming the IPv6 network header isis present in skb->head [1]
Add the needed pskbnetworkmaypull() calls for both IPv4 and IPv6 handlers.
[1] BUG: KMSAN: uninit-value in ipv6addrtype+0xa2/0x490 net/ipv6/addrconfcore.c:47 ipv6addrtype+0xa2/0x490 net/ipv6/addrconfcore.c:47 ipv6addrtype include/net/ipv6.h:555 [inline] ip6routeoutputflagsnoref net/ipv6/route.c:2616 [inline] ip6routeoutputflags+0x51/0x720 net/ipv6/route.c:2651 ip6routeoutput include/net/ip6route.h:93 [inline] ipvlanroutev6outbound+0x24e/0x520 drivers/net/ipvlan/ipvlancore.c:476 ipvlanprocessv6outbound drivers/net/ipvlan/ipvlancore.c:491 [inline] ipvlanprocessoutbound drivers/net/ipvlan/ipvlancore.c:541 [inline] ipvlanxmitmodel3 drivers/net/ipvlan/ipvlancore.c:605 [inline] ipvlanqueuexmit+0xd72/0x1780 drivers/net/ipvlan/ipvlancore.c:671 ipvlanstartxmit+0x5b/0x210 drivers/net/ipvlan/ipvlanmain.c:223 netdevstartxmit include/linux/netdevice.h:5150 [inline] netdevstartxmit include/linux/netdevice.h:5159 [inline] xmitone net/core/dev.c:3735 [inline] devhardstartxmit+0x247/0xa20 net/core/dev.c:3751 schdirectxmit+0x399/0xd40 net/sched/schgeneric.c:343 qdiscrestart net/sched/schgeneric.c:408 [inline] qdiscrun+0x14da/0x35d0 net/sched/schgeneric.c:416 qdiscrun+0x141/0x4d0 include/net/pktsched.h:127 nettxaction+0x78b/0x940 net/core/dev.c:5484 handlesoftirqs+0x1a0/0x7c0 kernel/softirq.c:561 dosoftirq+0x14/0x1a kernel/softirq.c:595 dosoftirq+0x9a/0x100 kernel/softirq.c:462 localbhenableip+0x9f/0xb0 kernel/softirq.c:389 localbhenable include/linux/bottomhalf.h:33 [inline] rcureadunlockbh include/linux/rcupdate.h:919 [inline] devqueuexmit+0x2758/0x57d0 net/core/dev.c:4611 devqueuexmit include/linux/netdevice.h:3311 [inline] packetxmit+0x9c/0x6c0 net/packet/afpacket.c:276 packetsnd net/packet/afpacket.c:3132 [inline] packetsendmsg+0x93e0/0xa7e0 net/packet/afpacket.c:3164 socksendmsgnosec net/socket.c:718 [inline]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel ipvlan outbound processing, add the needed pskb_network_may_pull() calls to both the IPv4 and IPv6 handlers so the network headers are present in the skb linear part.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21891?
CVE-2025-21891 has been assigned a severity level that indicates it can potentially affect the security and stability of systems running the Linux kernel.
How do I fix CVE-2025-21891?
To fix CVE-2025-21891, you should update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What does CVE-2025-21891 affect?
CVE-2025-21891 affects the Linux kernel, specifically the ipvlan networking feature.
How was CVE-2025-21891 discovered?
CVE-2025-21891 was discovered by syzbot, which identified an issue in the ipvlan_process_v6_outbound() function.
What are the potential impacts of CVE-2025-21891?
The potential impacts of CVE-2025-21891 include issues with network header processing that could lead to unexpected behavior in network communications.