CVE-2025-21920: vlan: enforce underlying device type
First published: Tue Apr 01 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leaks the address of a kernel function to usermode. When creating a VLAN device, we initialize GARP (garp_init_applicant) and MRP (mrp_init_applicant) for the underlying device. As part of the initialization process, we add the multicast address of each applicant to the underlying device, by calling dev_mc_add. __dev_mc_add uses dev->addr_len to determine the length of the new multicast address. This causes an out-of-bounds read if dev->addr_len is greater than 6, since the multicast addresses provided by GARP and MRP are only 6 bytes long. This behaviour can be reproduced using the following commands: ip tunnel add gretest mode ip6gre local ::1 remote ::2 dev lo ip l set up dev gretest ip link add link gretest name vlantest type vlan id 100 Then, the following command will display the address of garp_pdu_rcv: ip maddr show | grep 01:80:c2:00:00:21 Fix the bug by enforcing the type of the underlying device during VLAN device initialization.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | >=2.6.35<5.4.291 | |
| Linux Kernel | >=5.5<5.10.235 | |
| Linux Kernel | >=5.11<5.15.179 | |
| Linux Kernel | >=5.16<6.1.131 | |
| Linux Kernel | >=6.2<6.6.83 | |
| Linux Kernel | >=6.7<6.12.19 | |
| Linux Kernel | >=6.13<6.13.7 | |
| Linux Kernel | =6.14-rc1 | |
| Linux Kernel | =6.14-rc2 | |
| Linux Kernel | =6.14-rc3 | |
| Linux Kernel | =6.14-rc4 | |
| Linux Kernel | =6.14-rc5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/7f1564b2b2072b7aa1ac75350e9560a07c7a44fd
- https://git.kernel.org/stable/c/fa40ebef69234e39ec2d26930d045f2fb9a8cb2b
- https://git.kernel.org/stable/c/0fb7aa04c19eac4417f360a9f7611a60637bdacc
- https://git.kernel.org/stable/c/5a515d13e15536e82c5c7c83eb6cf5bc4827fee5
- https://git.kernel.org/stable/c/3561442599804905c3defca241787cd4546e99a7
- https://git.kernel.org/stable/c/30e8aee77899173a82ae5ed89f536c096f20aaeb
- https://git.kernel.org/stable/c/b6c72479748b7ea09f53ed64b223cee6463dc278
- https://git.kernel.org/stable/c/b33a534610067ade2bdaf2052900aaad99701353
Frequently Asked Questions
What is the severity of CVE-2025-21920?
CVE-2025-21920 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-21920?
To remediate CVE-2025-21920, update your Linux kernel to the latest stable version where this vulnerability has been resolved.
What type of vulnerability is CVE-2025-21920?
CVE-2025-21920 is a vulnerability related to VLAN device creation on non-ethernet underlying devices in the Linux kernel.
What are the implications of CVE-2025-21920?
The implications of CVE-2025-21920 include potential information leakage and instability when VLANs are misconfigured on inappropriate device types.
Does CVE-2025-21920 affect all Linux kernel versions?
CVE-2025-21920 affects certain Linux kernel versions prior to the fix, so it is essential to check your kernel version for exposure.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/source
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/remedy
- agent/softwarecombine
- agent/tags
- vendor/linux
- canonical/linux kernel
- version/linux kernel/2.6.35
- version/linux kernel/5.5
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.13
- version/linux kernel/6.14-rc1
- version/linux kernel/6.14-rc2
- version/linux kernel/6.14-rc3
- version/linux kernel/6.14-rc4
- version/linux kernel/6.14-rc5