ipvlan: ensure network headers are in skb linear part

{
  "id": "d5ec077b6cc3be20804f5967e0ecf2dcaa50d749101507f03c46784f443b3df7",
  "url": "https://osv.dev/vulnerability/CVE-2025-21891",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ipvlan: ensure network headers are in skb linear part",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: ipvlan: ensure network headers are in skb linear part syzbot found that ipvlan_process_v6_outbound() was assuming the IPv6 network header isis present in skb->head [1] Add the needed pskb_network_may_pull() calls for both IPv4 and IPv6 handlers. [1] BUG: KMSAN: uninit-value in __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47 __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47 ipv6_addr_type include/net/ipv6.h:555 [inline] ip6_route_output_flags_noref net/ipv6/route.c:2616 [inline] ip6_route_output_flags+0x51/0x720 net/ipv6/route.c:2651 ip6_route_output include/net/ip6_route.h:93 [inline] ipvlan_route_v6_outbound+0x24e/0x520 drivers/net/ipvlan/ipvlan_core.c:476 ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:491 [inline] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:541 [inline] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:605 [inline] ipvlan_queue_xmit+0xd72/0x1780 drivers/net/ipvlan/ipvlan_core.c:671 ipvlan_start_xmit+0x5b/0x210 drivers/net/ipvlan/ipvlan_main.c:223 __netdev_start_xmit include/linux/netdevice.h:5150 [inline] netdev_start_xmit include/linux/netdevice.h:5159 [inline] xmit_one net/core/dev.c:3735 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3751 sch_direct_xmit+0x399/0xd40 net/sched/sch_generic.c:343 qdisc_restart net/sched/sch_generic.c:408 [inline] __qdisc_run+0x14da/0x35d0 net/sched/sch_generic.c:416 qdisc_run+0x141/0x4d0 include/net/pkt_sc",
    "evidence": "osv:CVE-2025-21891",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.130",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.81",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.18",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.13.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-21891",
      "aliases": [
        "CVE-2025-21891"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "2ad7bf3638411cb547f2823df08166c13ab04269"
                },
                {
                  "fixed": "5b8dea8d1612dc7151d2457d7d2e6a69820309bf"
                },
                {
                  "fixed": "4ec48f812804f370f622e0874e6dd8fcc58241cd"
                },
                {
                  "fixed": "5353fd89663c48f56bdff975c562cfe78b1a2e4c"
                },
                {
                  "fixed": "e2a4f76a2d8a44816ecd25bcbdb47b786d621974"
                },
                {
                  "fixed": "27843ce6ba3d3122b65066550fe33fb8839f8aef"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21891.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "3.19.0"
                },
                {
                  "fixed": "6.1.130"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.81"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.18"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.13.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21891.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.655123946Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/27843ce6ba3d3122b65066550fe33fb8839f8aef",
        "https://git.kernel.org/stable/c/4ec48f812804f370f622e0874e6dd8fcc58241cd",
        "https://git.kernel.org/stable/c/5353fd89663c48f56bdff975c562cfe78b1a2e4c",
        "https://git.kernel.org/stable/c/5b8dea8d1612dc7151d2457d7d2e6a69820309bf",
        "https://git.kernel.org/stable/c/e2a4f76a2d8a44816ecd25bcbdb47b786d621974",
        "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21891.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-21891",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21891.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-21891",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 504576,
  "published_at": "2025-03-27T14:57:17.267+00:00"
}