Uninitialized Value Access in Linux Kernel's VXLAN Module
Summary
CVE-2025-21716: In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix uninit-value in vxlan_vnifilter_dump() KMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1]. Affects linux versions < 6.1.129-1. Fixed in 6.1.129-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to applications. The VXLAN (Virtual Extensible LAN) module is a network virtualization technology that allows the encapsulation of Layer 2 Ethernet frames in Layer 4 UDP packets. This technology is crucial for creating virtualized network environments, especially in cloud computing and data center scenarios. However, vulnerabilities in the kernel can lead to severe security risks, including unauthorized access and system instability.
Vulnerability Detail
The vulnerability identified as CVE-2025-21716 pertains to an uninitialized value access in the vxlan_vnifilter_dump() function within the VXLAN module of the Linux kernel. This issue arises when the length of the netlink message payload is less than the size of the struct tunnel_msg, leading to the function accessing memory beyond the allocated message size. Such uninitialized memory access can result in unpredictable behavior, including potential information leaks or system crashes. The vulnerability was reported by KMSAN (Kernel Memory Sanitizer), which detected the uninitialized value access during runtime.
How To Fix
Minimum fixed version
6.1.129-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel to the latest version.
Conclusion
CVE-2025-21716 is a critical vulnerability in the Linux kernel's VXLAN module that can lead to uninitialized value access, posing risks to system stability and security. Users are urged to update their kernel to the patched version to protect against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21716 is a vulnerability in the Linux kernel's VXLAN module that allows for uninitialized value access, potentially leading to system instability.
If exploited, this vulnerability can lead to unpredictable behavior, including crashes or information leaks, affecting the stability and security of your system.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Yes, a patch has been released for this vulnerability. Users should update their Linux kernel to the latest version to ensure they are protected.
While there are no specific workarounds, it is recommended to prioritize updating your kernel as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
