GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21717 (GCVE-0-2025-21717)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:07 – Updated: 2026-08-05 11:53
VLAI
Title
net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq kvzalloc_node is not doing a runtime check on the node argument (__alloc_pages_node_noprof does have a VM_BUG_ON, but it expands to nothing on !CONFIG_DEBUG_VM builds), so doing any ethtool/netlink operation that calls mlx5e_open on a CPU that's larger that MAX_NUMNODES triggers OOB access and panic (see the trace below). Add missing cpu_to_node call to convert cpu id to node id. [ 165.427394] mlx5_core 0000:5c:00.0 beth1: Link up [ 166.479327] BUG: unable to handle page fault for address: 0000000800000010 [ 166.494592] #PF: supervisor read access in kernel mode [ 166.505995] #PF: error_code(0x0000) - not-present page ... [ 166.816958] Call Trace: [ 166.822380] <TASK> [ 166.827034] ? __die_body+0x64/0xb0 [ 166.834774] ? page_fault_oops+0x2cd/0x3f0 [ 166.843862] ? exc_page_fault+0x63/0x130 [ 166.852564] ? asm_exc_page_fault+0x22/0x30 [ 166.861843] ? __kvmalloc_node_noprof+0x43/0xd0 [ 166.871897] ? get_partial_node+0x1c/0x320 [ 166.880983] ? deactivate_slab+0x269/0x2b0 [ 166.890069] ___slab_alloc+0x521/0xa90 [ 166.898389] ? __kvmalloc_node_noprof+0x43/0xd0 [ 166.908442] __kmalloc_node_noprof+0x216/0x3f0 [ 166.918302] ? __kvmalloc_node_noprof+0x43/0xd0 [ 166.928354] __kvmalloc_node_noprof+0x43/0xd0 [ 166.938021] mlx5e_open_channels+0x5e2/0xc00 [ 166.947496] mlx5e_open_locked+0x3e/0xf0 [ 166.956201] mlx5e_open+0x23/0x50 [ 166.963551] __dev_open+0x114/0x1c0 [ 166.971292] __dev_change_flags+0xa2/0x1b0 [ 166.980378] dev_change_flags+0x21/0x60 [ 166.988887] do_setlink+0x38d/0xf20 [ 166.996628] ? ep_poll_callback+0x1b9/0x240 [ 167.005910] ? __nla_validate_parse.llvm.10713395753544950386+0x80/0xd70 [ 167.020782] ? __wake_up_sync_key+0x52/0x80 [ 167.030066] ? __mutex_lock+0xff/0x550 [ 167.038382] ? security_capable+0x50/0x90 [ 167.047279] rtnl_setlink+0x1c9/0x210 [ 167.055403] ? ep_poll_callback+0x1b9/0x240 [ 167.064684] ? security_capable+0x50/0x90 [ 167.073579] rtnetlink_rcv_msg+0x2f9/0x310 [ 167.082667] ? rtnetlink_bind+0x30/0x30 [ 167.091173] netlink_rcv_skb+0xb1/0xe0 [ 167.099492] netlink_unicast+0x20f/0x2e0 [ 167.108191] netlink_sendmsg+0x389/0x420 [ 167.116896] __sys_sendto+0x158/0x1c0 [ 167.125024] __x64_sys_sendto+0x22/0x30 [ 167.133534] do_syscall_64+0x63/0x130 [ 167.141657] ? __irq_exit_rcu.llvm.17843942359718260576+0x52/0xd0 [ 167.155181] entry_SYSCALL_64_after_hwframe+0x4b/0x53
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bb135e40129ddd254cfb474b58981313be79a631 , < a275db45b4161d01716559dd7557db9ea0450952 (git)
Affected: bb135e40129ddd254cfb474b58981313be79a631 , < 979284535aaf12a287a2f43d9d5dfcbdc1dc4cac (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a275db45b4161d01716559dd7557db9ea0450952",
              "status": "affected",
              "version": "bb135e40129ddd254cfb474b58981313be79a631",
              "versionType": "git"
            },
            {
              "lessThan": "979284535aaf12a287a2f43d9d5dfcbdc1dc4cac",
              "status": "affected",
              "version": "bb135e40129ddd254cfb474b58981313be79a631",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq\n\nkvzalloc_node is not doing a runtime check on the node argument\n(__alloc_pages_node_noprof does have a VM_BUG_ON, but it expands to\nnothing on !CONFIG_DEBUG_VM builds), so doing any ethtool/netlink\noperation that calls mlx5e_open on a CPU that\u0027s larger that MAX_NUMNODES\ntriggers OOB access and panic (see the trace below).\n\nAdd missing cpu_to_node call to convert cpu id to node id.\n\n[  165.427394] mlx5_core 0000:5c:00.0 beth1: Link up\n[  166.479327] BUG: unable to handle page fault for address: 0000000800000010\n[  166.494592] #PF: supervisor read access in kernel mode\n[  166.505995] #PF: error_code(0x0000) - not-present page\n...\n[  166.816958] Call Trace:\n[  166.822380]  \u003cTASK\u003e\n[  166.827034]  ? __die_body+0x64/0xb0\n[  166.834774]  ? page_fault_oops+0x2cd/0x3f0\n[  166.843862]  ? exc_page_fault+0x63/0x130\n[  166.852564]  ? asm_exc_page_fault+0x22/0x30\n[  166.861843]  ? __kvmalloc_node_noprof+0x43/0xd0\n[  166.871897]  ? get_partial_node+0x1c/0x320\n[  166.880983]  ? deactivate_slab+0x269/0x2b0\n[  166.890069]  ___slab_alloc+0x521/0xa90\n[  166.898389]  ? __kvmalloc_node_noprof+0x43/0xd0\n[  166.908442]  __kmalloc_node_noprof+0x216/0x3f0\n[  166.918302]  ? __kvmalloc_node_noprof+0x43/0xd0\n[  166.928354]  __kvmalloc_node_noprof+0x43/0xd0\n[  166.938021]  mlx5e_open_channels+0x5e2/0xc00\n[  166.947496]  mlx5e_open_locked+0x3e/0xf0\n[  166.956201]  mlx5e_open+0x23/0x50\n[  166.963551]  __dev_open+0x114/0x1c0\n[  166.971292]  __dev_change_flags+0xa2/0x1b0\n[  166.980378]  dev_change_flags+0x21/0x60\n[  166.988887]  do_setlink+0x38d/0xf20\n[  166.996628]  ? ep_poll_callback+0x1b9/0x240\n[  167.005910]  ? __nla_validate_parse.llvm.10713395753544950386+0x80/0xd70\n[  167.020782]  ? __wake_up_sync_key+0x52/0x80\n[  167.030066]  ? __mutex_lock+0xff/0x550\n[  167.038382]  ? security_capable+0x50/0x90\n[  167.047279]  rtnl_setlink+0x1c9/0x210\n[  167.055403]  ? ep_poll_callback+0x1b9/0x240\n[  167.064684]  ? security_capable+0x50/0x90\n[  167.073579]  rtnetlink_rcv_msg+0x2f9/0x310\n[  167.082667]  ? rtnetlink_bind+0x30/0x30\n[  167.091173]  netlink_rcv_skb+0xb1/0xe0\n[  167.099492]  netlink_unicast+0x20f/0x2e0\n[  167.108191]  netlink_sendmsg+0x389/0x420\n[  167.116896]  __sys_sendto+0x158/0x1c0\n[  167.125024]  __x64_sys_sendto+0x22/0x30\n[  167.133534]  do_syscall_64+0x63/0x130\n[  167.141657]  ? __irq_exit_rcu.llvm.17843942359718260576+0x52/0xd0\n[  167.155181]  entry_SYSCALL_64_after_hwframe+0x4b/0x53"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered only through local configuration interfaces \u2014 rtnetlink `RTM_SETLINK`/`SIOCSIFFLAGS` bringing the interface up, or ethtool channel/ring/coalesce reconfiguration \u2014 as shown by the `netlink_sendmsg \u2192 rtnl_setlink \u2192 do_setlink \u2192 __dev_open \u2192 mlx5e_open` trace. No remote packet processing reaches `mlx5e_open_channels()`.\nAC:L - On any affected host (CPU ids \u003e= MAX_NUMNODES, i.e. \u003e64 CPUs on x86_64 default `NODES_SHIFT=6` or \u003e16 on arm64\u0027s `NODES_SHIFT=4` \u2014 the norm for servers with ConnectX NICs) a simple `ip link set dev X up` triggers it deterministically and repeatably, and the attacker can additionally sweep the out-of-bounds index space by varying the channel count with `ethtool -L` until one lands on a `slab_nodes` bit that is set.\nPR:L - The gate is CAP_NET_ADMIN evaluated against the network namespace\u0027s user namespace (`netlink_net_capable()` \u2192 `sock_net(sk)-\u003euser_ns` at rtnetlink.c:6850, `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)` in ethtool), so an unprivileged host user who is root in a user-namespaced container holding a delegated mlx5 VF or subfunction netdev \u2014 the standard SR-IOV/SF container deployment for this driver \u2014 can bring the link up and panic the whole host.\nUI:N - The attacker performs the interface-up or ethtool reconfiguration entirely on their own; no action by any other user or administrator is needed.\nS:U - The out-of-bounds access and its consequences are confined to the kernel\u0027s own memory and the kernel security authority; there is no hypervisor, IOMMU, or DMA boundary crossed.\nC:H - The bug reads a pointer out of bounds from beyond `struct kmem_cache`\u0027s trailing `node[MAX_NUMNODES]` array and hands it to the allocator, which then treats unrelated kernel memory as a `kmem_cache_node` and returns objects carved from it; the resulting corrupted freelist hands wild pointers to unrelated kmalloc callers, exposing arbitrary kernel memory contents.\nI:H - The wild pointer is not merely read \u2014 `spin_lock_irqsave(\u0026n-\u003elist_lock)`, `remove_partial()`/`list_del()`, `n-\u003enr_partial--`, and the `__GFP_ZERO` memset over `sizeof(struct mlx5e_xdpsq)` all write through it, giving unvalidated writes into kernel memory outside any allocation, with the attacker selecting which adjacent pointer is used via the channel count.\nA:H - The documented, reproducible outcome is an immediate unhandled supervisor page fault (\"BUG: unable to handle page fault for address: 0000000800000010\") inside the slab allocator, oopsing the task while holding allocator state and panicking the machine on every interface bring-up."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:52.706Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a275db45b4161d01716559dd7557db9ea0450952"
        },
        {
          "url": "https://git.kernel.org/stable/c/979284535aaf12a287a2f43d9d5dfcbdc1dc4cac"
        }
      ],
      "title": "net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21717",
    "datePublished": "2025-02-27T02:07:27.369Z",
    "dateReserved": "2024-12-29T08:45:45.753Z",
    "dateUpdated": "2026-08-05T11:53:52.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21717",
      "date": "2026-09-17",
      "epss": "0.00169",
      "percentile": "0.06656"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21717\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T02:15:15.373\",\"lastModified\":\"2026-07-30T06:20:27.063\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq\\n\\nkvzalloc_node is not doing a runtime check on the node argument\\n(__alloc_pages_node_noprof does have a VM_BUG_ON, but it expands to\\nnothing on !CONFIG_DEBUG_VM builds), so doing any ethtool/netlink\\noperation that calls mlx5e_open on a CPU that\u0027s larger that MAX_NUMNODES\\ntriggers OOB access and panic (see the trace below).\\n\\nAdd missing cpu_to_node call to convert cpu id to node id.\\n\\n[  165.427394] mlx5_core 0000:5c:00.0 beth1: Link up\\n[  166.479327] BUG: unable to handle page fault for address: 0000000800000010\\n[  166.494592] #PF: supervisor read access in kernel mode\\n[  166.505995] #PF: error_code(0x0000) - not-present page\\n...\\n[  166.816958] Call Trace:\\n[  166.822380]  \u003cTASK\u003e\\n[  166.827034]  ? __die_body+0x64/0xb0\\n[  166.834774]  ? page_fault_oops+0x2cd/0x3f0\\n[  166.843862]  ? exc_page_fault+0x63/0x130\\n[  166.852564]  ? asm_exc_page_fault+0x22/0x30\\n[  166.861843]  ? __kvmalloc_node_noprof+0x43/0xd0\\n[  166.871897]  ? get_partial_node+0x1c/0x320\\n[  166.880983]  ? deactivate_slab+0x269/0x2b0\\n[  166.890069]  ___slab_alloc+0x521/0xa90\\n[  166.898389]  ? __kvmalloc_node_noprof+0x43/0xd0\\n[  166.908442]  __kmalloc_node_noprof+0x216/0x3f0\\n[  166.918302]  ? __kvmalloc_node_noprof+0x43/0xd0\\n[  166.928354]  __kvmalloc_node_noprof+0x43/0xd0\\n[  166.938021]  mlx5e_open_channels+0x5e2/0xc00\\n[  166.947496]  mlx5e_open_locked+0x3e/0xf0\\n[  166.956201]  mlx5e_open+0x23/0x50\\n[  166.963551]  __dev_open+0x114/0x1c0\\n[  166.971292]  __dev_change_flags+0xa2/0x1b0\\n[  166.980378]  dev_change_flags+0x21/0x60\\n[  166.988887]  do_setlink+0x38d/0xf20\\n[  166.996628]  ? ep_poll_callback+0x1b9/0x240\\n[  167.005910]  ? __nla_validate_parse.llvm.10713395753544950386+0x80/0xd70\\n[  167.020782]  ? __wake_up_sync_key+0x52/0x80\\n[  167.030066]  ? __mutex_lock+0xff/0x550\\n[  167.038382]  ? security_capable+0x50/0x90\\n[  167.047279]  rtnl_setlink+0x1c9/0x210\\n[  167.055403]  ? ep_poll_callback+0x1b9/0x240\\n[  167.064684]  ? security_capable+0x50/0x90\\n[  167.073579]  rtnetlink_rcv_msg+0x2f9/0x310\\n[  167.082667]  ? rtnetlink_bind+0x30/0x30\\n[  167.091173]  netlink_rcv_skb+0xb1/0xe0\\n[  167.099492]  netlink_unicast+0x20f/0x2e0\\n[  167.108191]  netlink_sendmsg+0x389/0x420\\n[  167.116896]  __sys_sendto+0x158/0x1c0\\n[  167.125024]  __x64_sys_sendto+0x22/0x30\\n[  167.133534]  do_syscall_64+0x63/0x130\\n[  167.141657]  ? __irq_exit_rcu.llvm.17843942359718260576+0x52/0xd0\\n[  167.155181]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: agregar cpu_to_node faltante a kvzalloc_node en mlx5e_open_xdpredirect_sq kvzalloc_node no est\u00e1 realizando una verificaci\u00f3n en tiempo de ejecuci\u00f3n en el argumento del nodo (__alloc_pages_node_noprof tiene un VM_BUG_ON, pero se expande a nada en las compilaciones !CONFIG_DEBUG_VM), por lo que realizar cualquier operaci\u00f3n ethtool/netlink que llame a mlx5e_open en una CPU que sea m\u00e1s grande que MAX_NUMNODES desencadena el acceso OOB y el p\u00e1nico (vea el seguimiento a continuaci\u00f3n). Agregue la llamada cpu_to_node faltante para convertir la identificaci\u00f3n de la CPU en identificaci\u00f3n del nodo. [ 165.427394] mlx5_core 0000:5c:00.0 beth1: Enlace activo [ 166.479327] ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: 0000000800000010 [ 166.494592] #PF: acceso de lectura del supervisor en modo kernel [ 166.505995] #PF: error_code(0x0000) - p\u00e1gina no presente ... [ 166.816958] Seguimiento de llamadas: [ 166.822380]  [ 166.827034] ? __die_body+0x64/0xb0 [ 166.834774] ? page_fault_oops+0x2cd/0x3f0 [ 166.843862] ? exc_page_fault+0x63/0x130 [ 166.852564] ? asm_exc_page_fault+0x22/0x30 [ 166.861843] ? __kvmalloc_node_noprof+0x43/0xd0 [ 166.871897] ? get_partial_node+0x1c/0x320 [ 166.880983] ? deactivate_slab+0x269/0x2b0 [ 166.890069] ___slab_alloc+0x521/0xa90 [ 166.898389] ? __kvmalloc_node_noprof+0x43/0xd0 [ 166.908442] __kmalloc_node_noprof+0x216/0x3f0 [ 166.918302] ? __kvmalloc_node_noprof+0x43/0xd0 [ 166.928354] __kvmalloc_node_noprof+0x43/0xd0 [ 166.938021] mlx5e_open_channels+0x5e2/0xc00 [ 166.947496] mlx5e_open_locked+0x3e/0xf0 [ 166.956201] mlx5e_open+0x23/0x50 [ 166.963551] __dev_open+0x114/0x1c0 [ 166.971292] __dev_change_flags+0xa2/0x1b0 [ 166.980378] dev_change_flags+0x21/0x60 [ 166.988887] do_setlink+0x38d/0xf20 [ 166.996628] ? ep_poll_callback+0x1b9/0x240 [ 167.005910] ? __nla_validate_parse.llvm.10713395753544950386+0x80/0xd70 [ 167.020782] ? __wake_up_sync_key+0x52/0x80 [ 167.030066] ? __mutex_lock+0xff/0x550 [ 167.038382] ? security_capable+0x50/0x90 [ 167.047279] rtnl_setlink+0x1c9/0x210 [ 167.055403] ? ep_poll_callback+0x1b9/0x240 [ 167.064684] ? security_capable+0x50/0x90 [ 167.073579] rtnetlink_rcv_msg+0x2f9/0x310 [ 167.082667] ? rtnetlink_bind+0x30/0x30 [ 167.091173] netlink_rcv_skb+0xb1/0xe0 [ 167.099492] netlink_unicast+0x20f/0x2e0 [ 167.108191] netlink_sendmsg+0x389/0x420 [ 167.116896] __sys_sendto+0x158/0x1c0 [ 167.125024] __x64_sys_sendto+0x22/0x30 [ 167.133534] do_syscall_64+0x63/0x130 [ 167.141657] ? __irq_exit_rcu.llvm.17843942359718260576+0x52/0xd0 [ 167.155181] entry_SYSCALL_64_after_hwframe+0x4b/0x53\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bb135e40129ddd254cfb474b58981313be79a631\",\"lessThan\":\"a275db45b4161d01716559dd7557db9ea0450952\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bb135e40129ddd254cfb474b58981313be79a631\",\"lessThan\":\"979284535aaf12a287a2f43d9d5dfcbdc1dc4cac\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.2\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.2\",\"matchCriteriaId\":\"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/979284535aaf12a287a2f43d9d5dfcbdc1dc4cac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a275db45b4161d01716559dd7557db9ea0450952\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:35:50+00:00",
      "cve": "CVE-2025-21717",
      "id": "CVE-2025-21717",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21717.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.