CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling
In the Linux kernel, the following vulnerability has been resolved:
devlink: fix xaalloccyclic() error handling
In case of returning 1 from xaalloccyclic() (wrapping) ERRPTR(1) will be returned, which will cause ISERR() to be false. Which can lead to dereference not allocated pointer (rel).
Fix it by checking if err is lower than zero.
This wasn't found in real usecase, only noticed. Credit to Pierre.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.21-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.21 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.13.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1 - Compensating control
In devlink error handling, check whether the xa_alloc_cyclic() return value is lower than zero before treating it as an error, because a return value of 1 (wrapping) can produce ERR_PTR(1), for which IS_ERR() is false.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22017?
CVE-2025-22017 is considered a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-22017?
To fix CVE-2025-22017, update your Linux kernel to the latest patched version.
What types of systems are affected by CVE-2025-22017?
CVE-2025-22017 affects systems running the Linux kernel that utilize the devlink feature.
What are the potential consequences of CVE-2025-22017?
CVE-2025-22017 could lead to dereferencing uninitialized memory, causing unpredictability in application behavior.
Is there a workaround for CVE-2025-22017?
There are currently no known workarounds for CVE-2025-22017 besides applying the kernel update.