CVE-2025-21997: xsk: fix an integer overflow in xp_create_and_assign_umem()
In the Linux kernel, the following vulnerability has been resolved:
xsk: fix an integer overflow in xpcreateandassignumem()
Since the i and pool->chunksize variables are of type 'u32', their product can wrap around and then be cast to 'u64'. This can lead to two different XDP buffers pointing to the same memory area.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21997?
CVE-2025-21997 is considered a high-severity vulnerability due to the potential for integer overflow leading to system instability.
How do I fix CVE-2025-21997?
To fix CVE-2025-21997, you should update to the latest version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2025-21997?
CVE-2025-21997 affects the Linux kernel, impacting systems that utilize vulnerable versions.
What type of vulnerability is CVE-2025-21997?
CVE-2025-21997 is an integer overflow vulnerability in the Linux kernel's xsk module.
Can CVE-2025-21997 be exploited remotely?
CVE-2025-21997 may allow local user privileges to escalate, but it is not typically exploited remotely.