Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2025-21868— net: allow small head cache usage with large MAX_SKB_FRAGS values

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于允许在大的MAX_SKB_FRAGS值下使用小的头缓存，可能导致警告。

CVSS 7.5 · High EPSS 0.39% · P32 Updated Aug 05, 2026

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 10

Vendor	Product	Version Range	Status
Linux	Linux	`3948b05950fdd64002a5f182c65ba5cf2d53cf71< ed8a77fee4618facd2a539cad7b7366697b5a575`	affected
		`3948b05950fdd64002a5f182c65ba5cf2d53cf71< ed0ca7d2127c63991cfaf1932b827e3f4f8ee480`	affected
		`3948b05950fdd64002a5f182c65ba5cf2d53cf71< 648e440c98e260dec835e48a5d7a9993477b1f9d`	affected
		`3948b05950fdd64002a5f182c65ba5cf2d53cf71< 14ad6ed30a10afbe91b0749d6378285f4225d482`	affected
		`6.4`	affected
		`< 6.4`	unaffected
		`6.6.117≤ 6.6.*`	unaffected
		`6.12.17≤ 6.12.*`	unaffected
… +2 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21868

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

net: allow small head cache usage with large MAX_SKB_FRAGS values

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: net: allow small head cache usage with large MAX_SKB_FRAGS values Sabrina reported the following splat: WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:netif_napi_add_weight_locked+0x8f2/0xba0 Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe <0f> 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48 RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6 RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168 R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007 FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> gro_cells_init+0x1ba/0x270 xfrm_input_init+0x4b/0x2a0 xfrm_init+0x38/0x50 ip_rt_init+0x2d7/0x350 ip_init+0xf/0x20 inet_init+0x406/0x590 do_one_initcall+0x9d/0x2e0 do_initcalls+0x23b/0x280 kernel_init_freeable+0x445/0x490 kernel_init+0x20/0x1d0 ret_from_fork+0x46/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> irq event stamp: 584330 hardirqs last enabled at (584338): [<ffffffff8168bf87>] __up_console_sem+0x77/0xb0 hardirqs last disabled at (584345): [<ffffffff8168bf6c>] __up_console_sem+0x5c/0xb0 softirqs last enabled at (583242): [<ffffffff833ee96d>] netlink_insert+0x14d/0x470 softirqs last disabled at (583754): [<ffffffff8317c8cd>] netif_napi_add_weight_locked+0x77d/0xba0 on kernel built with MAX_SKB_FRAGS=45, where SKB_WITH_OVERHEAD(1024) is smaller than GRO_MAX_HEAD. Such built additionally contains the revert of the single page frag cache so that napi_get_frags() ends up using the page frag allocator, triggering the splat. Note that the underlying issue is independent from the mentioned revert; address it ensuring that the small head cache will fit either TCP and GRO allocation and updating napi_alloc_skb() and __netdev_alloc_skb() to select kmalloc() usage for any allocation fitting such cache.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	3948b05950fdd64002a5f182c65ba5cf2d53cf71 ~ ed8a77fee4618facd2a539cad7b7366697b5a575	-
Linux	Linux	6.4	-

II. Public POCs for CVE-2025-21868

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-21868

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21868 (3)

https://www.cve.org/CVERecord?id=CVE-2025-21868

Same Patch Batch · Linux · 2025-03-27 · 124 CVEs total

CVE-2023-53006	9.8 CRITICAL	cifs: Fix oops due to uncleared server->smbd_conn in reconnect
CVE-2025-21876	8.8 HIGH	iommu/vt-d: Fix suspicious RCU usage
CVE-2025-21890	8.2 HIGH	idpf: fix checksums set in idpf_rx_rsc()
CVE-2022-49755	7.8 HIGH	usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
CVE-2025-21887	7.8 HIGH	ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
CVE-2025-21889	7.8 HIGH	perf/core: Add RCU read lock protection to perf_iterate_ctx()
CVE-2023-52930	7.8 HIGH	drm/i915: Fix potential bit_17 double-free
CVE-2023-52931	7.8 HIGH	drm/i915: Avoid potential vm use-after-free
CVE-2023-52934	7.8 HIGH	mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups
CVE-2023-52935	7.8 HIGH	mm/khugepaged: fix ->anon_vma race
CVE-2023-53009	7.8 HIGH	drm/amdkfd: Add sync after creating vram bo
CVE-2023-52999	7.8 HIGH	net: fix UaF in netns ops registration error path
CVE-2023-52973	7.8 HIGH	vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
CVE-2023-52981	7.8 HIGH	drm/i915: Fix request ref counting during error capture & debugfs dump
CVE-2023-52983	7.8 HIGH	block, bfq: fix uaf for bfqq in bic_set_bfqq()
CVE-2023-52975	7.8 HIGH	scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
CVE-2023-52974	7.8 HIGH	scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
CVE-2023-52987	7.8 HIGH	ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write()
CVE-2025-21867	7.8 HIGH	bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
CVE-2023-52988	7.8 HIGH	ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()

Showing top 20 of 124 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2025-21868

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-21868— net: allow small head cache usage with large MAX_SKB_FRAGS values

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 10

I. Basic Information for CVE-2025-21868

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2025-21868

III. Intelligence Information for CVE-2025-21868

Patches & Fixes for CVE-2025-21868 (3)

Same Patch Batch · Linux · 2025-03-27 · 124 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2025-21868

Leave a comment