Vulnerability-Lookup

GHSA-MG35-FW68-X22W

Vulnerability from github – Published: 2025-01-21 15:31 – Updated: 2025-10-15 15:30

Details

In the Linux kernel, the following vulnerability has been resolved:

netdev: prevent accessing NAPI instances from another namespace

The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock.

napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id().

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-21659"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-21T13:15:09Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetdev: prevent accessing NAPI instances from another namespace\n\nThe NAPI IDs were not fully exposed to user space prior to the netlink\nAPI, so they were never namespaced. The netlink API must ensure that\nat the very least NAPI instance belongs to the same netns as the owner\nof the genl sock.\n\nnapi_by_id() can become static now, but it needs to move because of\ndev_get_by_napi_id().",
  "id": "GHSA-mg35-fw68-x22w",
  "modified": "2025-10-15T15:30:21Z",
  "published": "2025-01-21T15:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21659"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b683ba0df11ff563cc237eb1b74d6adfa77226bf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d1cacd74776895f6435941f86a1130e58f6dd226"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-21659 (GCVE-0-2025-21659)

Vulnerability from cvelistv5 – Published: 2025-01-21 12:18 – Updated: 2026-08-05 11:53

Title

netdev: prevent accessing NAPI instances from another namespace

Summary

In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock. napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id().

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7056 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/b683ba0df11ff563c…
https://git.kernel.org/stable/c/d1cacd74776895f64…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 27f91aaf49b3a50e5a02ad5fa27b7c453d029a72 , < b683ba0df11ff563cc237eb1b74d6adfa77226bf (git) Affected: 27f91aaf49b3a50e5a02ad5fa27b7c453d029a72 , < d1cacd74776895f6435941f86a1130e58f6dd226 (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.10 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c",
            "net/core/dev.h",
            "net/core/netdev-genl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b683ba0df11ff563cc237eb1b74d6adfa77226bf",
              "status": "affected",
              "version": "27f91aaf49b3a50e5a02ad5fa27b7c453d029a72",
              "versionType": "git"
            },
            {
              "lessThan": "d1cacd74776895f6435941f86a1130e58f6dd226",
              "status": "affected",
              "version": "27f91aaf49b3a50e5a02ad5fa27b7c453d029a72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c",
            "net/core/dev.h",
            "net/core/netdev-genl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetdev: prevent accessing NAPI instances from another namespace\n\nThe NAPI IDs were not fully exposed to user space prior to the netlink\nAPI, so they were never namespaced. The netlink API must ensure that\nat the very least NAPI instance belongs to the same netns as the owner\nof the genl sock.\n\nnapi_by_id() can become static now, but it needs to move because of\ndev_get_by_napi_id()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through a generic-netlink socket (NETDEV family, NAPI_GET/NAPI_SET commands), which requires local execution on the target system. No remote or adjacent network path exists.\nAC:L - NAPI IDs are allocated sequentially from a small base (napi_gen_id starting at NR_CPUS, floor MIN_NAPI_ID), so an attacker can exhaustively enumerate every NAPI instance on the system in a trivial loop; there is no race, no memory-layout dependency, and the result is fully deterministic.\nPR:H - The read/info-leak path (NETDEV_CMD_NAPI_GET) needs no privileges at all, but the highest-impact path (NETDEV_CMD_NAPI_SET) is gated by GENL_ADMIN_PERM, which resolves to netlink_capable() against init_user_ns \u2014 i.e. real CAP_NET_ADMIN that cannot be obtained via unshare -Urn. This is routinely held by netns-confined containers and sandboxes (CNI plugins, VPN sidecars, ip netns exec, PrivateNetwork services) that are nonetheless meant to be isolated from the host\u0027s devices.\nUI:N - The attacker sends netlink messages entirely on their own; no victim action, mount, or file open is needed.\nS:C - The network namespace is the security authority that decides which net devices a process may observe and configure, and this bug lets a process confined to one netns read and reconfigure NAPI instances belonging to devices in the host or another tenant\u0027s netns. The impacted resources lie outside the vulnerable component\u0027s security scope, i.e. a sandbox/container boundary escape.\nC:L - netdev_nl_napi_fill_one() discloses a bounded but real set of cross-namespace data \u2014 the foreign device\u0027s ifindex, its hardware IRQ number, the NAPI kernel thread\u0027s PID in the init pid namespace, and all NAPI tunables \u2014 which leaks host topology and PID information into an isolated namespace. It is a limited, structured leak rather than an arbitrary memory read.\nI:H - netdev_nl_napi_set_config() lets the attacker write defer_hard_irqs, gro_flush_timeout and irq_suspend_timeout on every NAPI instance in the system, including the host\u0027s physical NICs \u2014 total control of that configuration surface across the namespace boundary, with direct and serious consequences for the impacted devices.\nA:H - Setting a large defer_hard_irqs together with a huge gro_flush_timeout makes napi_complete_done() return false so the driver never re-arms hardware interrupts, while napi-\u003etimer is armed far in the future \u2014 the targeted NIC\u0027s receive path stops being serviced, producing a complete network outage on the host or a co-tenant namespace from inside an isolated container."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:25.796Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b683ba0df11ff563cc237eb1b74d6adfa77226bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1cacd74776895f6435941f86a1130e58f6dd226"
        }
      ],
      "title": "netdev: prevent accessing NAPI instances from another namespace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21659",
    "datePublished": "2025-01-21T12:18:15.407Z",
    "dateReserved": "2024-12-29T08:45:45.732Z",
    "dateUpdated": "2026-08-05T11:53:25.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted