Memory Allocation Error in Linux Kernel's FEC Driver - CVE-2025-21676
Summary
CVE-2025-21676: In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd function calls page_pool_dev_alloc_pages but did not handle the case when it re... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a critical component of many operating systems, providing the core functionalities required for hardware interaction and resource management. The FEC (Fast Ethernet Controller) driver is responsible for managing network communications over Ethernet interfaces. This driver is essential for ensuring reliable data transmission in various environments, including embedded systems. However, it is susceptible to vulnerabilities that can arise from improper error handling, particularly during memory allocation processes.
Vulnerability Detail
CVE-2025-21676 is a vulnerability in the Linux kernel's FEC driver, specifically within the fec_enet_update_cbd function. The issue occurs when the function calls page_pool_dev_alloc_pages, which may return NULL under memory pressure conditions. Despite a warning being triggered (WARN_ON(!new_page)), the driver continues to operate using the NULL pointer, leading to a potential system crash. This vulnerability can manifest more frequently when the system is under heavy memory load, such as during file transfers over a network share. The failure to handle memory allocation errors correctly poses significant risks to system stability and reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can adjust the system's memory management settings by increasing the value of /proc/sys/vm/min_free_kbytes. This adjustment may help alleviate the issue under certain conditions. To do this, run the following command:
echo 65536 | sudo tee /proc/sys/vm/min_free_kbytes
This command sets the minimum free memory threshold to 65536 KB, which may reduce the likelihood of encountering the vulnerability.
Conclusion
CVE-2025-21676 is a significant vulnerability in the Linux kernel's FEC driver that can lead to system crashes due to improper memory allocation error handling. Users are advised to update their Linux packages to the latest versions to mitigate this risk. Temporary workarounds are available, but the best course of action is to apply the necessary updates.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21676 is a vulnerability in the Linux kernel's FEC driver that can lead to system crashes due to improper handling of memory allocation errors.
If your system is running an affected version of the Linux kernel, it may crash under memory pressure when using the FEC driver, especially during network data transfers.
You can implement a temporary workaround by increasing the min_free_kbytes setting in your system's memory management configuration.
Detailed information about CVE-2025-21676 can be found in the official CVE database and security advisories related to the Linux kernel.
Vulert allows you to monitor and receive alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, without needing to access the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
