linux-cve-announce - CVE-2025-21806: net: let net.core.dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022753-CVE-2025-21806-7910@gregkh>
Date: Thu, 27 Feb 2025 12:00:00 -0800
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-21806: net: let net.core.dev_weight always be non-zero

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: let net.core.dev_weight always be non-zero

The following problem was encountered during stability test:

(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \
	returned 1, exceeding its budget of 0.
------------[ cut here ]------------
list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \
	next=ffff88905f746e40.
WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \
	__list_add_valid_or_report+0xf3/0x130
CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+
RIP: 0010:__list_add_valid_or_report+0xf3/0x130
Call Trace:
? __warn+0xcd/0x250
? __list_add_valid_or_report+0xf3/0x130
enqueue_to_backlog+0x923/0x1070
netif_rx_internal+0x92/0x2b0
__netif_rx+0x15/0x170
loopback_xmit+0x2ef/0x450
dev_hard_start_xmit+0x103/0x490
__dev_queue_xmit+0xeac/0x1950
ip_finish_output2+0x6cc/0x1620
ip_output+0x161/0x270
ip_push_pending_frames+0x155/0x1a0
raw_sendmsg+0xe13/0x1550
__sys_sendto+0x3bf/0x4e0
__x64_sys_sendto+0xdc/0x1b0
do_syscall_64+0x5b/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7e

The reproduction command is as follows:
  sysctl -w net.core.dev_weight=0
  ping 127.0.0.1

This is because when the napi's weight is set to 0, process_backlog() may
return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this
napi to be re-polled in net_rx_action() until __do_softirq() times out.
Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can
be retriggered in enqueue_to_backlog(), causing this issue.

Making the napi's weight always non-zero solves this problem.

Triggering this issue requires system-wide admin (setting is
not namespaced).

The Linux kernel CVE team has assigned CVE-2025-21806 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.12 with commit e3876605450979fe52a1a03e7eb78a89bf59e76a and fixed in 6.1.129 with commit 5860abbf15eeb61838b5e32e721ba67b0aa84450
	Issue introduced in 2.6.12 with commit e3876605450979fe52a1a03e7eb78a89bf59e76a and fixed in 6.6.76 with commit 6ce38b5a6a49e65bad163162a54cb3f104c40b48
	Issue introduced in 2.6.12 with commit e3876605450979fe52a1a03e7eb78a89bf59e76a and fixed in 6.12.13 with commit 33e2168788f8fb5cb8bd4f36cb1ef37d1d34dada
	Issue introduced in 2.6.12 with commit e3876605450979fe52a1a03e7eb78a89bf59e76a and fixed in 6.13.2 with commit 1489824e5226a26841c70639ebd2d1aed390764b
	Issue introduced in 2.6.12 with commit e3876605450979fe52a1a03e7eb78a89bf59e76a and fixed in 6.14-rc1 with commit d1f9f79fa2af8e3b45cffdeef66e05833480148a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21806
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/core/sysctl_net_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5860abbf15eeb61838b5e32e721ba67b0aa84450
	https://git.kernel.org/stable/c/6ce38b5a6a49e65bad163162a54cb3f104c40b48
	https://git.kernel.org/stable/c/33e2168788f8fb5cb8bd4f36cb1ef37d1d34dada
	https://git.kernel.org/stable/c/1489824e5226a26841c70639ebd2d1aed390764b
	https://git.kernel.org/stable/c/d1f9f79fa2af8e3b45cffdeef66e05833480148a