In the Linux kernel, the following vulnerability has been resolved:
vsock/bpf: return early if transport is not assigned
Some of the core functions can only be called if the transport has been assigned.
As Michal reported, a socket might have the transport at NULL, for example after a failed connect(), causing the following trace:
BUG: kernel NULL pointer dereference, address: 00000000000000a0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0
Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+
RIP: 0010:vsock_connectible_has_data+0x1f/0x40
Call Trace:
vsock_bpf_recvmsg+0xca/0x5e0
sock_recvmsg+0xb9/0xc0
__sys_recvfrom+0xb3/0x130
__x64_sys_recvfrom+0x20/0x30
do_syscall_64+0x93/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e
So we need to check the vsk->transport
in vsockbpfrecvmsg(),
especially for connected sockets (stream/seqpacket) as we already
do in _vsockconnectible_recvmsg().
[ { "digest": { "line_hashes": [ "165088970496734108022404490426936268430", "105347590334646371546235906797881658886", "153629928676698392498144567693182155602", "147034645154321740165290866314761591992", "94323720629531888120373540181710988731", "236837575350864021139719219080161309168", "329856614387761279214477844615353691184", "245196746938428344631657763203981564365", "115609052297124719002522140724079058374", "70607434768863039685560575635366767020", "128040134861722504695419330244244801023" ], "threshold": 0.9 }, "id": "CVE-2025-21670-44ef4e48", "target": { "file": "net/vmw_vsock/vsock_bpf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58e586c30d0b6f5dc0174a41026f2b0a48c9aab6", "signature_version": "v1", "signature_type": "Line", "deprecated": false }, { "digest": { "line_hashes": [ "165088970496734108022404490426936268430", "105347590334646371546235906797881658886", "153629928676698392498144567693182155602", "147034645154321740165290866314761591992", "94323720629531888120373540181710988731", "236837575350864021139719219080161309168", "329856614387761279214477844615353691184", "245196746938428344631657763203981564365", "115609052297124719002522140724079058374", "70607434768863039685560575635366767020", "128040134861722504695419330244244801023" ], "threshold": 0.9 }, "id": "CVE-2025-21670-58de2507", "target": { "file": "net/vmw_vsock/vsock_bpf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6abafcd32f9cfc4b1a2f820ecea70773e26d423", "signature_version": "v1", "signature_type": "Line", "deprecated": false }, { "digest": { "line_hashes": [ "165088970496734108022404490426936268430", "105347590334646371546235906797881658886", "153629928676698392498144567693182155602", "147034645154321740165290866314761591992", "94323720629531888120373540181710988731", "236837575350864021139719219080161309168", "329856614387761279214477844615353691184", "245196746938428344631657763203981564365", "115609052297124719002522140724079058374", "70607434768863039685560575635366767020", "128040134861722504695419330244244801023" ], "threshold": 0.9 }, "id": "CVE-2025-21670-5bf603f3", "target": { "file": "net/vmw_vsock/vsock_bpf.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6771e1279dadf1d92a72e1465134257d9e6f2459", "signature_version": "v1", "signature_type": "Line", "deprecated": false }, { "digest": { "function_hash": "308906523999320238095720730434849908870", "length": 862.0 }, "id": "CVE-2025-21670-99c9f9d3", "target": { "file": "net/vmw_vsock/vsock_bpf.c", "function": "vsock_bpf_recvmsg" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6771e1279dadf1d92a72e1465134257d9e6f2459", "signature_version": "v1", "signature_type": "Function", "deprecated": false }, { "digest": { "function_hash": "308906523999320238095720730434849908870", "length": 862.0 }, "id": "CVE-2025-21670-d477cf76", "target": { "file": "net/vmw_vsock/vsock_bpf.c", "function": "vsock_bpf_recvmsg" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6abafcd32f9cfc4b1a2f820ecea70773e26d423", "signature_version": "v1", "signature_type": "Function", "deprecated": false }, { "digest": { "function_hash": "308906523999320238095720730434849908870", "length": 862.0 }, "id": "CVE-2025-21670-f79584bc", "target": { "file": "net/vmw_vsock/vsock_bpf.c", "function": "vsock_bpf_recvmsg" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58e586c30d0b6f5dc0174a41026f2b0a48c9aab6", "signature_version": "v1", "signature_type": "Function", "deprecated": false } ]