CVE-2025-22106 (GCVE-0-2025-22106)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:12 – Updated: 2025-09-25 09:49
VLAI?
Title
vmxnet3: unregister xdp rxq info in the reset path
Summary
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: unregister xdp rxq info in the reset path vmxnet3 does not unregister xdp rxq info in the vmxnet3_reset_work() code path as vmxnet3_rq_destroy() is not invoked in this code path. So, we get below message with a backtrace. Missing unregister, handled but fix driver WARNING: CPU:48 PID: 500 at net/core/xdp.c:182 __xdp_rxq_info_reg+0x93/0xf0 This patch fixes the problem by moving the unregister code of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup().
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 54f00cce11786742bd11e5e68c3bf85e6dc048c9 , < a6157484bee3385a425d288a69e1eaf03232f5fc (git)
Affected: 54f00cce11786742bd11e5e68c3bf85e6dc048c9 , < 23da4e0bb2a38966d29db0ff90a8fe68fdfa1744 (git)
Affected: 54f00cce11786742bd11e5e68c3bf85e6dc048c9 , < 9908541a9e235b7c5e2fbdd59910eaf9c32c3075 (git)
Affected: 54f00cce11786742bd11e5e68c3bf85e6dc048c9 , < 0dd765fae295832934bf28e45dd5a355e0891ed4 (git)
Create a notification for this product.
    Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.108 , ≤ 6.6.* (semver)
Unaffected: 6.12.49 , ≤ 6.12.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vmxnet3/vmxnet3_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a6157484bee3385a425d288a69e1eaf03232f5fc",
              "status": "affected",
              "version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
              "versionType": "git"
            },
            {
              "lessThan": "23da4e0bb2a38966d29db0ff90a8fe68fdfa1744",
              "status": "affected",
              "version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
              "versionType": "git"
            },
            {
              "lessThan": "9908541a9e235b7c5e2fbdd59910eaf9c32c3075",
              "status": "affected",
              "version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
              "versionType": "git"
            },
            {
              "lessThan": "0dd765fae295832934bf28e45dd5a355e0891ed4",
              "status": "affected",
              "version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vmxnet3/vmxnet3_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: unregister xdp rxq info in the reset path\n\nvmxnet3 does not unregister xdp rxq info in the\nvmxnet3_reset_work() code path as vmxnet3_rq_destroy()\nis not invoked in this code path. So, we get below message with a\nbacktrace.\n\nMissing unregister, handled but fix driver\nWARNING: CPU:48 PID: 500 at net/core/xdp.c:182\n__xdp_rxq_info_reg+0x93/0xf0\n\nThis patch fixes the problem by moving the unregister\ncode of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-25T09:49:08.249Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a6157484bee3385a425d288a69e1eaf03232f5fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/23da4e0bb2a38966d29db0ff90a8fe68fdfa1744"
        },
        {
          "url": "https://git.kernel.org/stable/c/9908541a9e235b7c5e2fbdd59910eaf9c32c3075"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dd765fae295832934bf28e45dd5a355e0891ed4"
        }
      ],
      "title": "vmxnet3: unregister xdp rxq info in the reset path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22106",
    "datePublished": "2025-04-16T14:12:54.461Z",
    "dateReserved": "2024-12-29T08:45:45.820Z",
    "dateUpdated": "2025-09-25T09:49:08.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22106\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T15:16:04.913\",\"lastModified\":\"2025-11-03T18:42:40.573\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvmxnet3: unregister xdp rxq info in the reset path\\n\\nvmxnet3 does not unregister xdp rxq info in the\\nvmxnet3_reset_work() code path as vmxnet3_rq_destroy()\\nis not invoked in this code path. So, we get below message with a\\nbacktrace.\\n\\nMissing unregister, handled but fix driver\\nWARNING: CPU:48 PID: 500 at net/core/xdp.c:182\\n__xdp_rxq_info_reg+0x93/0xf0\\n\\nThis patch fixes the problem by moving the unregister\\ncode of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vmxnet3: anular el registro de la informaci\u00f3n de xdp rxq en la ruta de reinicio vmxnet3 no anula el registro de la informaci\u00f3n de xdp rxq en la ruta de c\u00f3digo vmxnet3_reset_work() ya que vmxnet3_rq_destroy() no se invoca en esta ruta de c\u00f3digo. Por lo tanto, obtenemos el siguiente mensaje con un backtrace. Falta anulaci\u00f3n del registro, gestionada pero corregida el controlador ADVERTENCIA: CPU:48 PID: 500 en net/core/xdp.c:182 __xdp_rxq_info_reg+0x93/0xf0 Este parche corrige el problema moviendo el c\u00f3digo de anulaci\u00f3n del registro de XDP de vmxnet3_rq_destroy() a vmxnet3_rq_cleanup().\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.108\",\"matchCriteriaId\":\"6014655E-7044-4F9B-B5E6-497BDF9C2DBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.49\",\"matchCriteriaId\":\"CAA033E9-A2C5-4976-A83E-9804D8FB827F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.2\",\"matchCriteriaId\":\"633A38C1-75C8-452D-8F1C-DA0269FD2687\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0dd765fae295832934bf28e45dd5a355e0891ed4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/23da4e0bb2a38966d29db0ff90a8fe68fdfa1744\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9908541a9e235b7c5e2fbdd59910eaf9c32c3075\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6157484bee3385a425d288a69e1eaf03232f5fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.