CVE-2025-21883

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21883
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21883.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21883
Downstream
Related
Published
2025-03-27T14:57:11Z
Modified
2025-10-17T22:24:27.478485Z
Summary
ice: Fix deinitializing VF in error path
Details

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix deinitializing VF in error path

If iceenavfs() fails after calling icecreatevf_entries(), it frees all VFs without removing them from snapshot PF-VF mailbox list, leading to list corruption.

Reproducer: devlink dev eswitch set $PF1PCI mode switchdev ip l s $PF1 up ip l s $PF1 promisc on sleep 1 echo 1 > /sys/class/net/$PF1/device/sriovnumvfs sleep 1 echo 1 > /sys/class/net/$PF1/device/sriov_numvfs

Trace (minimized): listadd corruption. next->prev should be prev (ffff8882e241c6f0), but was 0000000000000000. (next=ffff888455da1330). kernel BUG at lib/listdebug.c:29! RIP: 0010:_listaddvalidorreport+0xa6/0x100 icembxinitvfinfo+0xa7/0x180 [ice] iceinitializevfentry+0x1fa/0x250 [ice] icesriovconfigure+0x8d7/0x1520 [ice] ? _percpurefswitchmode+0x1b1/0x5d0 ? _pfxicesriovconfigure+0x10/0x10 [ice]

Sometimes a KASAN report can be seen instead with a similar stack trace: BUG: KASAN: use-after-free in _listaddvalidor_report+0xf1/0x100

VFs are added to this list in icembxinitvfinfo(), but only removed in icefreevfs(). Move the removing to icefreevfentries(), which is also being called in other places where VFs are being removed (including icefree_vfs() itself).

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8cd8a6b17d275a45e3722d0215f6115b687c8c3e
Fixed
3c01102bec9592928e6b155da41cfcd5d25a2066
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8cd8a6b17d275a45e3722d0215f6115b687c8c3e
Fixed
a4880583f88deba63504ce1c8287a70d39c01378
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8cd8a6b17d275a45e3722d0215f6115b687c8c3e
Fixed
34393fd78d7183a007eaf0090966ebedcc29bd57
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8cd8a6b17d275a45e3722d0215f6115b687c8c3e
Fixed
79990cf5e7aded76d0c092c9f5ed31eb1c75e02c

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.2
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.13.1
v6.13.2
v6.13.3
v6.13.4
v6.13.5
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.3
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.35
v6.6.36
v6.6.37
v6.6.38
v6.6.39
v6.6.4
v6.6.40
v6.6.41
v6.6.42
v6.6.43
v6.6.44
v6.6.45
v6.6.46
v6.6.47
v6.6.48
v6.6.49
v6.6.5
v6.6.50
v6.6.51
v6.6.52
v6.6.53
v6.6.54
v6.6.55
v6.6.56
v6.6.57
v6.6.58
v6.6.59
v6.6.6
v6.6.60
v6.6.61
v6.6.62
v6.6.63
v6.6.64
v6.6.65
v6.6.66
v6.6.67
v6.6.68
v6.6.69
v6.6.7
v6.6.70
v6.6.71
v6.6.72
v6.6.73
v6.6.74
v6.6.75
v6.6.76
v6.6.77
v6.6.78
v6.6.79
v6.6.8
v6.6.80
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-0814a9ec",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_vf_lib_private.h"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4880583f88deba63504ce1c8287a70d39c01378",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "2473522207413054528804801608484083861",
                "85930728251875324503460889386931444196",
                "121847434453316334666515863244483676588",
                "256683675793084574875954816134739661972"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-0bf5c6e6",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@79990cf5e7aded76d0c092c9f5ed31eb1c75e02c",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "183067389070484265409333178019231852488",
                "181758388044319192556956501244011526573",
                "160297043541638521870196509262077433013",
                "89360053643695204927766312773425960330",
                "244825594826379215441830696885748864133",
                "158275714486333178052585678323621544169",
                "83005689087035107637116666530142050065",
                "92615080212795623142961414847716359463",
                "97717219426173672943074838277518235123"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-0f8c12d4",
        "target": {
            "function": "ice_free_vfs",
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@79990cf5e7aded76d0c092c9f5ed31eb1c75e02c",
        "signature_type": "Function",
        "digest": {
            "function_hash": "324482763321079317541788639185379754396",
            "length": 1359.0
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-33e4073c",
        "target": {
            "function": "ice_free_vf_entries",
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4880583f88deba63504ce1c8287a70d39c01378",
        "signature_type": "Function",
        "digest": {
            "function_hash": "16116475420073003231787196116555697478",
            "length": 273.0
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-3ee2f670",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_vf_lib_private.h"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c01102bec9592928e6b155da41cfcd5d25a2066",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "2473522207413054528804801608484083861",
                "85930728251875324503460889386931444196",
                "121847434453316334666515863244483676588",
                "256683675793084574875954816134739661972"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-49bad09e",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@79990cf5e7aded76d0c092c9f5ed31eb1c75e02c",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "272385087026347408553990652199228155242",
                "194855818734809481946474625105211991927",
                "106707026163338354696579559454003226223"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-5359e907",
        "target": {
            "function": "ice_free_vfs",
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4880583f88deba63504ce1c8287a70d39c01378",
        "signature_type": "Function",
        "digest": {
            "function_hash": "324482763321079317541788639185379754396",
            "length": 1359.0
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-5efab0f6",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_vf_lib_private.h"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@79990cf5e7aded76d0c092c9f5ed31eb1c75e02c",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "2473522207413054528804801608484083861",
                "85930728251875324503460889386931444196",
                "121847434453316334666515863244483676588",
                "256683675793084574875954816134739661972"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-696276af",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34393fd78d7183a007eaf0090966ebedcc29bd57",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "183067389070484265409333178019231852488",
                "181758388044319192556956501244011526573",
                "160297043541638521870196509262077433013",
                "89360053643695204927766312773425960330",
                "244825594826379215441830696885748864133",
                "158275714486333178052585678323621544169",
                "83005689087035107637116666530142050065",
                "92615080212795623142961414847716359463",
                "97717219426173672943074838277518235123"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-6acaae5f",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34393fd78d7183a007eaf0090966ebedcc29bd57",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "272385087026347408553990652199228155242",
                "194855818734809481946474625105211991927",
                "106707026163338354696579559454003226223"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-708858c7",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c01102bec9592928e6b155da41cfcd5d25a2066",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "183067389070484265409333178019231852488",
                "181758388044319192556956501244011526573",
                "160297043541638521870196509262077433013",
                "89360053643695204927766312773425960330",
                "244825594826379215441830696885748864133",
                "158275714486333178052585678323621544169",
                "83005689087035107637116666530142050065",
                "92615080212795623142961414847716359463",
                "97717219426173672943074838277518235123"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-9c2922a4",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4880583f88deba63504ce1c8287a70d39c01378",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "183067389070484265409333178019231852488",
                "181758388044319192556956501244011526573",
                "160297043541638521870196509262077433013",
                "89360053643695204927766312773425960330",
                "244825594826379215441830696885748864133",
                "158275714486333178052585678323621544169",
                "83005689087035107637116666530142050065",
                "92615080212795623142961414847716359463",
                "97717219426173672943074838277518235123"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-a221c40c",
        "target": {
            "function": "ice_free_vf_entries",
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c01102bec9592928e6b155da41cfcd5d25a2066",
        "signature_type": "Function",
        "digest": {
            "function_hash": "16116475420073003231787196116555697478",
            "length": 273.0
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-a8e1bb5f",
        "target": {
            "function": "ice_free_vf_entries",
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34393fd78d7183a007eaf0090966ebedcc29bd57",
        "signature_type": "Function",
        "digest": {
            "function_hash": "16116475420073003231787196116555697478",
            "length": 273.0
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-ab4f5dae",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_vf_lib_private.h"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34393fd78d7183a007eaf0090966ebedcc29bd57",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "2473522207413054528804801608484083861",
                "85930728251875324503460889386931444196",
                "121847434453316334666515863244483676588",
                "256683675793084574875954816134739661972"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-b3389e1f",
        "target": {
            "function": "ice_free_vfs",
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34393fd78d7183a007eaf0090966ebedcc29bd57",
        "signature_type": "Function",
        "digest": {
            "function_hash": "324482763321079317541788639185379754396",
            "length": 1359.0
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-bbfacb4b",
        "target": {
            "function": "ice_free_vfs",
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c01102bec9592928e6b155da41cfcd5d25a2066",
        "signature_type": "Function",
        "digest": {
            "function_hash": "247457834737593788918071431754567250280",
            "length": 1353.0
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-e129f2f6",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c01102bec9592928e6b155da41cfcd5d25a2066",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "272385087026347408553990652199228155242",
                "194855818734809481946474625105211991927",
                "106707026163338354696579559454003226223"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-e1c9c0d4",
        "target": {
            "file": "drivers/net/ethernet/intel/ice/ice_vf_lib.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4880583f88deba63504ce1c8287a70d39c01378",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "272385087026347408553990652199228155242",
                "194855818734809481946474625105211991927",
                "106707026163338354696579559454003226223"
            ]
        }
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-21883-e559f134",
        "target": {
            "function": "ice_free_vf_entries",
            "file": "drivers/net/ethernet/intel/ice/ice_sriov.c"
        },
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@79990cf5e7aded76d0c092c9f5ed31eb1c75e02c",
        "signature_type": "Function",
        "digest": {
            "function_hash": "16116475420073003231787196116555697478",
            "length": 273.0
        }
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.6.81
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.18
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.6