Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-21867— bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于eth_skb_pkt_type函数访问不包含以太网头的skb数据，可能导致释放后重用。

CVSS 7.8 · High EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux be3d72a2896cb24090f268dce4aa8a304d40bc23< f615fccfc689cb48977d275ac2e391297b52392b affected
be3d72a2896cb24090f268dce4aa8a304d40bc23< d56d8a23d95100b65f40438639dd82db2af81c11 affected
be3d72a2896cb24090f268dce4aa8a304d40bc23< 972bafed67ca73ad9a56448384281eb5fd5c0ba3 affected
be3d72a2896cb24090f268dce4aa8a304d40bc23< 1a9e1284e87d59b1303b69d1808d310821d6e5f7 affected
be3d72a2896cb24090f268dce4aa8a304d40bc23< 6b3d638ca897e099fa99bd6d02189d3176f80a47 affected
5.18 affected
< 5.18 unaffected
6.1.130≤ 6.1.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21867

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's data that didn't contain an Ethernet header. This occurs when bpf_prog_test_run_xdp() passes an invalid value as the user_data argument to bpf_test_init(). Fix this by returning an error when user_data is less than ETH_HLEN in bpf_test_init(). Additionally, remove the check for "if (user_size > size)" as it is unnecessary. [1] BUG: KMSAN: use-after-free in eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] BUG: KMSAN: use-after-free in eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 __xdp_build_skb_from_frame+0x5a8/0xa50 net/core/xdp.c:635 xdp_recv_frames net/bpf/test_run.c:272 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2954/0x3330 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0x148e/0x1b10 net/bpf/test_run.c:1318 bpf_prog_test_run+0x5b7/0xa30 kernel/bpf/syscall.c:4371 __sys_bpf+0x6a6/0xe20 kernel/bpf/syscall.c:5777 __do_sys_bpf kernel/bpf/syscall.c:5866 [inline] __se_sys_bpf kernel/bpf/syscall.c:5864 [inline] __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:5864 x64_sys_call+0x2ea0/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: free_pages_prepare mm/page_alloc.c:1056 [inline] free_unref_page+0x156/0x1320 mm/page_alloc.c:2657 __free_pages+0xa3/0x1b0 mm/page_alloc.c:4838 bpf_ringbuf_free kernel/bpf/ringbuf.c:226 [inline] ringbuf_map_free+0xff/0x1e0 kernel/bpf/ringbuf.c:235 bpf_map_free kernel/bpf/syscall.c:838 [inline] bpf_map_free_deferred+0x17c/0x310 kernel/bpf/syscall.c:862 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa2b/0x1b60 kernel/workqueue.c:3310 worker_thread+0xedf/0x1550 kernel/workqueue.c:3391 kthread+0x535/0x6b0 kernel/kthread.c:389 ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 CPU: 1 UID: 0 PID: 17276 Comm: syz.1.16450 Not tainted 6.12.0-05490-g9bb88c659673 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于eth_skb_pkt_type函数访问不包含以太网头的skb数据，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux be3d72a2896cb24090f268dce4aa8a304d40bc23 ~ f615fccfc689cb48977d275ac2e391297b52392b -
Linux Linux 5.18 -

II. Public POCs for CVE-2025-21867

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21867

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21867 (5)

Same Patch Batch · Linux · 2025-03-27 · 124 CVEs total

CVE-2023-53006 9.8 CRITICAL cifs: Fix oops due to uncleared server->smbd_conn in reconnect
CVE-2025-21876 8.8 HIGH iommu/vt-d: Fix suspicious RCU usage
CVE-2025-21890 8.2 HIGH idpf: fix checksums set in idpf_rx_rsc()
CVE-2023-52987 7.8 HIGH ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write()
CVE-2023-52934 7.8 HIGH mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups
CVE-2023-52935 7.8 HIGH mm/khugepaged: fix ->anon_vma race
CVE-2023-52931 7.8 HIGH drm/i915: Avoid potential vm use-after-free
CVE-2023-52930 7.8 HIGH drm/i915: Fix potential bit_17 double-free
CVE-2022-49755 7.8 HIGH usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
CVE-2022-49760 7.8 HIGH mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()
CVE-2023-52973 7.8 HIGH vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
CVE-2023-52974 7.8 HIGH scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
CVE-2025-21889 7.8 HIGH perf/core: Add RCU read lock protection to perf_iterate_ctx()
CVE-2025-21887 7.8 HIGH ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
CVE-2023-52975 7.8 HIGH scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
CVE-2023-52981 7.8 HIGH drm/i915: Fix request ref counting during error capture & debugfs dump
CVE-2023-52983 7.8 HIGH block, bfq: fix uaf for bfqq in bic_set_bfqq()
CVE-2025-21884 7.8 HIGH net: better track kernel sockets lifetime
CVE-2023-53023 7.8 HIGH net: nfc: Fix use-after-free in local_cleanup()
CVE-2023-53026 7.8 HIGH RDMA/core: Fix ib block iterator counter overflow

Showing top 20 of 124 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21867

No comments yet

Leave a comment