CVE-2025-21961
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-21961
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21961.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-21961
- Downstream
- Related
- Published
- 2025-04-01T16:15:27Z
- Modified
- 2025-10-01T18:15:40Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
eth: bnxt: fix truesize for mb-xdp-pass case
When mb-xdp is set and return is XDPPASS, packet is converted from xdpbuff to skbuff with xdpupdateskbsharedinfo() in bnxtxdpbuildskb(). bnxtxdpbuildskb() passes incorrect truesize argument to xdpupdateskbsharedinfo(). The truesize is calculated as BNXTRXPAGESIZE * sinfo->nrfrags but the skbsharedinfo was wiped by napibuildskb() before. So it stores sinfo->nrfrags before bnxtxdpbuildskb() and use it instead of getting skbsharedinfo from xdpgetsharedinfofrombuff().
Splat looks like: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skbtrycoalesce+0x504/0x590 Modules linked in: xtnat xttcpudp veth afpacket xtconntrack nftchainnat xtMASQUERADE nfconntracknetlink xfrmuser xtaddrtype nftcoms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3 RIP: 0010:skbtrycoalesce+0x504/0x590 Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? _warn+0x84/0x130 ? skbtrycoalesce+0x504/0x590 ? reportbug+0x18a/0x1a0 ? handlebug+0x53/0x90 ? excinvalidop+0x14/0x70 ? asmexcinvalidop+0x16/0x20 ? skbtrycoalesce+0x504/0x590 inetfragreasmfinish+0x11f/0x2e0 ipdefrag+0x37a/0x900 iplocaldeliver+0x51/0x120 ipsublistrcvfinish+0x64/0x70 ipsublistrcv+0x179/0x210 iplist_rcv+0xf9/0x130
How to reproduce: <Node A> ip link set $interface1 xdp obj xdp_pass.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interfac2 mtu 9000 up ip a a 10.0.0.2/24 dev $interface2 ping 10.0.0.1 -s 65000
Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.
- References