Skip to content
Heist/ feed
High

bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's data that didn't contain an Ethernet header. This occurs when bpf_prog_test_run_xdp() passes an invalid value as the user_data argument to bpf_test_init(). Fix this by returning an error when user_data is less than ETH_HLEN in bpf_test_init(). Additionally, remove the check for "if (user_size > size)" as it is unnecessary. [1] BUG: KMSAN: use-after-free in eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] BUG: KMSAN: use-after-free in eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 __xdp_build_skb_from_frame+0x5a8/0xa50 net/core/xdp.c:635 xdp_recv_frames net/bpf/test_run.c:272 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2954/0x3330 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0x148e/0x1b10 net/bpf/test_run.c:1318 bpf_prog_test_run+0x5b7/0xa30 kernel/bpf/syscall.c:4371 __sys_bpf+0x6a6/0xe20 kernel/bpf/syscall.c:5777 __do_sys_bpf kernel/bpf/syscall.c:5866 [inline] __se_sys_bpf kernel/bpf/syscall.c:5864 [inline] __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:5864 x64_sys_call+0x2ea0/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/com

Announced Source revision 1
Original source ↗

CVE-2025-21867

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-21867

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "be3d72a2896cb24090f268dce4aa8a304d40bc23",
        "lessThan": "f615fccfc689cb48977d275ac2e391297b52392b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be3d72a2896cb24090f268dce4aa8a304d40bc23",
        "lessThan": "d56d8a23d95100b65f40438639dd82db2af81c11",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be3d72a2896cb24090f268dce4aa8a304d40bc23",
        "lessThan": "972bafed67ca73ad9a56448384281eb5fd5c0ba3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be3d72a2896cb24090f268dce4aa8a304d40bc23",
        "lessThan": "1a9e1284e87d59b1303b69d1808d310821d6e5f7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be3d72a2896cb24090f268dce4aa8a304d40bc23",
        "lessThan": "6b3d638ca897e099fa99bd6d02189d3176f80a47",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/bpf/test_run.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.18"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.18",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.130",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.80",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.17",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.13.5",
        "versionType": "semver",
        "lessThanOrEqual": "6.13.*"
      },
      {
        "status": "unaffected",
        "version": "6.14",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/bpf/test_run.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-21867

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#26967 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement