CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix the crash issue for zero copy XDPTX action
There is a crash issue when running zero copy XDPTX action, the crash log is shown below.
[ 216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000 [ 216.187524] Internal error: Oops: 0000000096000144 [#1] SMP [ 216.301694] Call trace: [ 216.304130] dcachecleanpoc+0x20/0x38 (P) [ 216.308308] dmasyncsinglefordevice+0x1bc/0x1e0 [ 216.313351] stmmacxdpxmitxdpf+0x354/0x400 [ 216.317701] stmmacxdprunprog+0x164/0x368 [ 216.322139] stmmacnapipollrxtx+0xba8/0xf00 [ 216.326576] napipoll+0x40/0x218 [ 216.408054] Kernel panic - not syncing: Oops: Fatal exception in interrupt
For XDPTX action, the xdpbuff is converted to xdpframe by xdpconvertbufftoframe(). The memory type of the resulting xdpframe depends on the memory type of the xdpbuff. For page pool based xdpbuff it produces xdpframe with memory type MEMTYPEPAGEPOOL. For zero copy XSK pool based xdpbuff it produces xdpframe with memory type MEMTYPEPAGEORDER0. However, stmmacxdpxmitback() does not check the memory type and always uses the page pool type, this leads to invalid mappings and causes the crash. Therefore, check the xdpbuff memory type in stmmacxdpxmitback() to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.121.1-1 - Configuration
Update stmmac XDP_TX zero-copy transmit path so stmmac_xdp_xmit_back() checks the xdp_buff memory type and handles page-pool/xsk pool cases correctly instead of always relying on MEM_TYPE_PAGE_POOL.
Linux kernel networking (stmmac) xdp_convert_buff_to_frame() / stmmac_xdp_xmit_back() memory-type checking for zero-copy XDP_TX = Enable/check xdp_buff memory type before producing xdp_frame
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71095?
CVE-2025-71095 has been classified as a medium severity vulnerability due to the potential for system crashes.
How do I fix CVE-2025-71095?
To address CVE-2025-71095, you should upgrade your Linux kernel to the latest stable version that includes the fix for the zero copy XDP_TX action crash.
What components are affected by CVE-2025-71095?
CVE-2025-71095 affects the networking component of the Linux kernel, specifically the stmmac driver.
Can CVE-2025-71095 be exploited remotely?
Yes, CVE-2025-71095 can potentially be exploited remotely if the zero copy XDP_TX action is used in an exposed environment.
What is the nature of the crash in CVE-2025-71095?
The crash associated with CVE-2025-71095 occurs when the zero copy XDP_TX action is executed, leading to a failure in the system.