CVE-2025-21788 (GCVE-0-2025-21788)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-08-05 11:54
VLAI
Title
net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases If the XDP program doesn't result in XDP_PASS then we leak the memory allocated by am65_cpsw_build_skb(). It is pointless to allocate SKB memory before running the XDP program as we would be wasting CPU cycles for cases other than XDP_PASS. Move the SKB allocation after evaluating the XDP program result. This fixes the memleak. A performance boost is seen for XDP_DROP test. XDP_DROP test: Before: 460256 rx/s 0 err/s After: 784130 rx/s 0 err/s
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8acacc40f7337527ff84cd901ed2ef0a2b95b2b6 , < 1bba1d042107167164a0ae3a843fdf650ab005d7 (git)
Affected: 8acacc40f7337527ff84cd901ed2ef0a2b95b2b6 , < dc11f049612b9d926aca2e55f8dc9d82850d0da3 (git)
Affected: 8acacc40f7337527ff84cd901ed2ef0a2b95b2b6 , < 5db843258de1e4e6b1ef1cbd1797923c9e3de548 (git)
Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.16 , ≤ 6.12.* (semver)
Unaffected: 6.13.4 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21788",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:30:00.916275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:39.866Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/am65-cpsw-nuss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1bba1d042107167164a0ae3a843fdf650ab005d7",
              "status": "affected",
              "version": "8acacc40f7337527ff84cd901ed2ef0a2b95b2b6",
              "versionType": "git"
            },
            {
              "lessThan": "dc11f049612b9d926aca2e55f8dc9d82850d0da3",
              "status": "affected",
              "version": "8acacc40f7337527ff84cd901ed2ef0a2b95b2b6",
              "versionType": "git"
            },
            {
              "lessThan": "5db843258de1e4e6b1ef1cbd1797923c9e3de548",
              "status": "affected",
              "version": "8acacc40f7337527ff84cd901ed2ef0a2b95b2b6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/am65-cpsw-nuss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases\n\nIf the XDP program doesn\u0027t result in XDP_PASS then we leak the\nmemory allocated by am65_cpsw_build_skb().\n\nIt is pointless to allocate SKB memory before running the XDP\nprogram as we would be wasting CPU cycles for cases other than XDP_PASS.\nMove the SKB allocation after evaluating the XDP program result.\n\nThis fixes the memleak. A performance boost is seen for XDP_DROP test.\n\nXDP_DROP test:\nBefore: 460256 rx/s                  0 err/s\nAfter:  784130 rx/s                  0 err/s"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The leak is triggered entirely by frames arriving on the am65-cpsw ethernet RX path and processed by the XDP hook, with no local access required. Routed IP traffic from any remote host reaches the driver\u0027s receive path, so the vector is Network.\nAC:L - The attacker reliably controls the trigger by sending packets the deployed XDP program will not pass (the canonical XDP_DROP filtering deployment), and every such packet deterministically leaks an sk_buff. No race, no unpredictable memory layout, and no condition outside the attacker\u0027s influence is involved.\nPR:N - The vulnerable code runs in the NAPI receive handler before any protocol processing, authentication, or socket ownership check. An unauthenticated remote sender needs no credentials on the target at all.\nUI:N - The leak occurs automatically during packet reception in softirq context. No action by any local user or administrator is needed once the interface is up.\nS:U - The leaked memory and the resulting exhaustion are confined to the kernel of the affected host, with no crossing of a virtualization, IOMMU, or sandbox boundary. The vulnerable component and the impacted component share the same security authority.\nC:N - The orphaned sk_buff is simply never freed; nothing reads it back and no kernel data is exposed to the attacker. There is no out-of-bounds read, uninitialized-memory disclosure, or pointer leak.\nI:N - No memory is overwritten, no adjacent object is corrupted, and no attacker-controlled data alters kernel state. The failure is purely a missed kfree with no write primitive.\nA:H - The leak is unbounded and remotely driven at line rate \u2014 the commit\u0027s own benchmark implies roughly 100 MB/s of unreclaimable slab \u2014 which exhausts RAM on the embedded/industrial platforms this driver targets within seconds, causing OOM kills, hangs, and loss of the system. This is total denial of service by an unauthenticated attacker, not mere performance degradation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:25.991Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1bba1d042107167164a0ae3a843fdf650ab005d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc11f049612b9d926aca2e55f8dc9d82850d0da3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5db843258de1e4e6b1ef1cbd1797923c9e3de548"
        }
      ],
      "title": "net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21788",
    "datePublished": "2025-02-27T02:18:27.336Z",
    "dateReserved": "2024-12-29T08:45:45.766Z",
    "dateUpdated": "2026-08-05T11:54:25.991Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21788",
      "date": "2026-08-05",
      "epss": "0.0048",
      "percentile": "0.38885"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21788\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T03:15:19.663\",\"lastModified\":\"2026-07-30T06:21:30.810\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases\\n\\nIf the XDP program doesn\u0027t result in XDP_PASS then we leak the\\nmemory allocated by am65_cpsw_build_skb().\\n\\nIt is pointless to allocate SKB memory before running the XDP\\nprogram as we would be wasting CPU cycles for cases other than XDP_PASS.\\nMove the SKB allocation after evaluating the XDP program result.\\n\\nThis fixes the memleak. A performance boost is seen for XDP_DROP test.\\n\\nXDP_DROP test:\\nBefore: 460256 rx/s                  0 err/s\\nAfter:  784130 rx/s                  0 err/s\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ethernet: ti: am65-cpsw: corrige la fuga de memoria en ciertos casos de XDP Si el programa XDP no da como resultado XDP_PASS, filtramos la memoria asignada por am65_cpsw_build_skb(). No tiene sentido asignar memoria SKB antes de ejecutar el programa XDP, ya que estar\u00edamos desperdiciando ciclos de CPU para casos distintos a XDP_PASS. Mueva la asignaci\u00f3n de SKB despu\u00e9s de evaluar el resultado del programa XDP. Esto corrige la fuga de memoria. Se observa una mejora en el rendimiento de la prueba XDP_DROP. Prueba XDP_DROP: Antes: 460256 rx/s 0 err/s Despu\u00e9s: 784130 rx/s 0 err/s\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8acacc40f7337527ff84cd901ed2ef0a2b95b2b6\",\"lessThan\":\"1bba1d042107167164a0ae3a843fdf650ab005d7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8acacc40f7337527ff84cd901ed2ef0a2b95b2b6\",\"lessThan\":\"dc11f049612b9d926aca2e55f8dc9d82850d0da3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8acacc40f7337527ff84cd901ed2ef0a2b95b2b6\",\"lessThan\":\"5db843258de1e4e6b1ef1cbd1797923c9e3de548\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.16\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.4\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:30:00.916275Z\",\"id\":\"CVE-2025-21788\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.12.16\",\"matchCriteriaId\":\"FB84018C-08CC-4578-B5A7-296AAE265678\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.4\",\"matchCriteriaId\":\"2A2093ED-74A9-43F9-AC72-50030F374EA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1bba1d042107167164a0ae3a843fdf650ab005d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5db843258de1e4e6b1ef1cbd1797923c9e3de548\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc11f049612b9d926aca2e55f8dc9d82850d0da3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:38:44+00:00",
      "cve": "CVE-2025-21788",
      "id": "CVE-2025-21788",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21788.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21788\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:30:00.916275Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-401\", \"description\": \"CWE-401 Missing Release of Memory after Effective Lifetime\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:56:18.109Z\"}}], \"cna\": {\"title\": \"net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The leak is triggered entirely by frames arriving on the am65-cpsw ethernet RX path and processed by the XDP hook, with no local access required. Routed IP traffic from any remote host reaches the driver\u0027s receive path, so the vector is Network.\\nAC:L - The attacker reliably controls the trigger by sending packets the deployed XDP program will not pass (the canonical XDP_DROP filtering deployment), and every such packet deterministically leaks an sk_buff. No race, no unpredictable memory layout, and no condition outside the attacker\u0027s influence is involved.\\nPR:N - The vulnerable code runs in the NAPI receive handler before any protocol processing, authentication, or socket ownership check. An unauthenticated remote sender needs no credentials on the target at all.\\nUI:N - The leak occurs automatically during packet reception in softirq context. No action by any local user or administrator is needed once the interface is up.\\nS:U - The leaked memory and the resulting exhaustion are confined to the kernel of the affected host, with no crossing of a virtualization, IOMMU, or sandbox boundary. The vulnerable component and the impacted component share the same security authority.\\nC:N - The orphaned sk_buff is simply never freed; nothing reads it back and no kernel data is exposed to the attacker. There is no out-of-bounds read, uninitialized-memory disclosure, or pointer leak.\\nI:N - No memory is overwritten, no adjacent object is corrupted, and no attacker-controlled data alters kernel state. The failure is purely a missed kfree with no write primitive.\\nA:H - The leak is unbounded and remotely driven at line rate \\u2014 the commit\u0027s own benchmark implies roughly 100 MB/s of unreclaimable slab \\u2014 which exhausts RAM on the embedded/industrial platforms this driver targets within seconds, causing OOM kills, hangs, and loss of the system. This is total denial of service by an unauthenticated attacker, not mere performance degradation.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8acacc40f7337527ff84cd901ed2ef0a2b95b2b6\", \"lessThan\": \"1bba1d042107167164a0ae3a843fdf650ab005d7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8acacc40f7337527ff84cd901ed2ef0a2b95b2b6\", \"lessThan\": \"dc11f049612b9d926aca2e55f8dc9d82850d0da3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8acacc40f7337527ff84cd901ed2ef0a2b95b2b6\", \"lessThan\": \"5db843258de1e4e6b1ef1cbd1797923c9e3de548\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1bba1d042107167164a0ae3a843fdf650ab005d7\"}, {\"url\": \"https://git.kernel.org/stable/c/dc11f049612b9d926aca2e55f8dc9d82850d0da3\"}, {\"url\": \"https://git.kernel.org/stable/c/5db843258de1e4e6b1ef1cbd1797923c9e3de548\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases\\n\\nIf the XDP program doesn\u0027t result in XDP_PASS then we leak the\\nmemory allocated by am65_cpsw_build_skb().\\n\\nIt is pointless to allocate SKB memory before running the XDP\\nprogram as we would be wasting CPU cycles for cases other than XDP_PASS.\\nMove the SKB allocation after evaluating the XDP program result.\\n\\nThis fixes the memleak. A performance boost is seen for XDP_DROP test.\\n\\nXDP_DROP test:\\nBefore: 460256 rx/s                  0 err/s\\nAfter:  784130 rx/s                  0 err/s\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.16\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.4\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:54:25.991Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21788\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:54:25.991Z\", \"dateReserved\": \"2024-12-29T08:45:45.766Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-27T02:18:27.336Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.