CVE-2025-21808 (GCVE-0-2025-21808)

Vulnerability from cvelistv5 – Published: 2025-02-27 20:01 – Updated: 2026-08-05 11:54
VLAI
Title
net: xdp: Disallow attaching device-bound programs in generic mode
Summary
In the Linux kernel, the following vulnerability has been resolved: net: xdp: Disallow attaching device-bound programs in generic mode Device-bound programs are used to support RX metadata kfuncs. These kfuncs are driver-specific and rely on the driver context to read the metadata. This means they can't work in generic XDP mode. However, there is no check to disallow such programs from being attached in generic mode, in which case the metadata kfuncs will be called in an invalid context, leading to crashes. Fix this by adding a check to disallow attaching device-bound programs in generic mode.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < b1bc4a35a04cbeb85b6ef5911ec015baa424989f (git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 557707906dd3e34b8a8c265f664d19f95799937e (git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1 (git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 3595599fa8360bb3c7afa7ee50c810b4a64106ea (git)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.76 , ≤ 6.6.* (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b1bc4a35a04cbeb85b6ef5911ec015baa424989f",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "557707906dd3e34b8a8c265f664d19f95799937e",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "3595599fa8360bb3c7afa7ee50c810b4a64106ea",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.76",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xdp: Disallow attaching device-bound programs in generic mode\n\nDevice-bound programs are used to support RX metadata kfuncs. These\nkfuncs are driver-specific and rely on the driver context to read the\nmetadata. This means they can\u0027t work in generic XDP mode. However, there\nis no check to disallow such programs from being attached in generic\nmode, in which case the metadata kfuncs will be called in an invalid\ncontext, leading to crashes.\n\nFix this by adding a check to disallow attaching device-bound programs\nin generic mode."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls \u2014 bpf(BPF_PROG_LOAD) to create the device-bound program and netlink/BPF-link attach with XDP_FLAGS_SKB_MODE \u2014 before any packet can trigger the bad kfunc call. The packet trigger can be self-generated on a locally created veth pair, so no network position is needed.\nAC:L - The sequence is fully deterministic and attacker-controlled: create a veth pair, load a dev-bound XDP program calling bpf_xdp_metadata_rx_hash(), attach it in generic mode, then send one frame. No race, no special hardware, and the attacker can groom the kernel stack to control the value the driver callback consumes.\nPR:L - The attach side needs only CAP_NET_ADMIN in the target netns, which any unprivileged user obtains via `unshare -Urn`, and BPF program loading is reachable at low privilege in the delegated-BPF-token container deployments this feature targets. Consistent with kernel.org CNA scoring of other BPF program-loading vulnerabilities.\nUI:N - The attacker performs every step \u2014 program load, generic-mode attach, and packet injection \u2014 with no action by any other user or administrator.\nS:U - The wild-pointer read and write occur in kernel memory within the same security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The driver kfuncs dereference an uninitialized stack value as a driver-context pointer and return the loaded kernel memory (mlx5 CQE timestamp, ice RSS hash, veth skb_hwtstamps) into the BPF program, which exports it to userspace \u2014 a kernel-memory read primitive plus stack-content and KASLR disclosure.\nI:H - veth_xdp_rx_hash() reaches __skb_set_sw_hash() and stores through the bogus skb pointer, giving a write at an attacker-influenceable kernel address; combined with the read primitive this is exploitable memory corruption.\nA:H - Dereferencing a stale stack value as a driver descriptor/skb pointer in softirq (NAPI) context reliably oopses or panics the kernel, and the commit message explicitly states the invalid kfunc context leads to crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:35.691Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b1bc4a35a04cbeb85b6ef5911ec015baa424989f"
        },
        {
          "url": "https://git.kernel.org/stable/c/557707906dd3e34b8a8c265f664d19f95799937e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3595599fa8360bb3c7afa7ee50c810b4a64106ea"
        }
      ],
      "title": "net: xdp: Disallow attaching device-bound programs in generic mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21808",
    "datePublished": "2025-02-27T20:01:00.328Z",
    "dateReserved": "2024-12-29T08:45:45.772Z",
    "dateUpdated": "2026-08-05T11:54:35.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21808",
      "date": "2026-08-06",
      "epss": "0.002",
      "percentile": "0.09949"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21808\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T20:16:03.410\",\"lastModified\":\"2026-07-30T06:21:38.247\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: xdp: Disallow attaching device-bound programs in generic mode\\n\\nDevice-bound programs are used to support RX metadata kfuncs. These\\nkfuncs are driver-specific and rely on the driver context to read the\\nmetadata. This means they can\u0027t work in generic XDP mode. However, there\\nis no check to disallow such programs from being attached in generic\\nmode, in which case the metadata kfuncs will be called in an invalid\\ncontext, leading to crashes.\\n\\nFix this by adding a check to disallow attaching device-bound programs\\nin generic mode.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: xdp: No permitir adjuntar programas vinculados al dispositivo en modo gen\u00e9rico Los programas vinculados al dispositivo se utilizan para admitir las kfuncs de metadatos RX. Estas kfuncs son espec\u00edficas del controlador y dependen del contexto del controlador para leer los metadatos. Esto significa que no pueden funcionar en modo XDP gen\u00e9rico. Sin embargo, no hay ninguna verificaci\u00f3n para no permitir que dichos programas se adjunten en modo gen\u00e9rico, en cuyo caso las kfuncs de metadatos se llamar\u00e1n en un contexto no v\u00e1lido, lo que provocar\u00e1 fallas. Solucione esto agregando una verificaci\u00f3n para no permitir adjuntar programas vinculados al dispositivo en modo gen\u00e9rico.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2b3486bc2d237ec345b3942b7be5deabf8c8fed1\",\"lessThan\":\"b1bc4a35a04cbeb85b6ef5911ec015baa424989f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b3486bc2d237ec345b3942b7be5deabf8c8fed1\",\"lessThan\":\"557707906dd3e34b8a8c265f664d19f95799937e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b3486bc2d237ec345b3942b7be5deabf8c8fed1\",\"lessThan\":\"5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b3486bc2d237ec345b3942b7be5deabf8c8fed1\",\"lessThan\":\"3595599fa8360bb3c7afa7ee50c810b4a64106ea\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.76\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.13\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.2\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.76\",\"matchCriteriaId\":\"743AF020-5140-4702-8AF3-B688405596B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.13\",\"matchCriteriaId\":\"2897389C-A8C3-4D69-90F2-E701B3D66373\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.2\",\"matchCriteriaId\":\"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3595599fa8360bb3c7afa7ee50c810b4a64106ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/557707906dd3e34b8a8c265f664d19f95799937e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1bc4a35a04cbeb85b6ef5911ec015baa424989f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:39:00+00:00",
      "cve": "CVE-2025-21808",
      "id": "CVE-2025-21808",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:known_affected": "226",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: xdp: Disallow attaching device-bound programs in generic mode",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21808.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.