Critical Memory Management Vulnerability in Linux Kernel: CVE-2025-21961
Summary
CVE-2025-21961: In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management, process scheduling, and system calls. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the kernel's handling of network packets, specifically in the context of the bnxt driver, which is responsible for managing Broadcom NetXtreme Ethernet devices. The issue arises when the kernel improperly calculates the truesize of packets, potentially leading to system instability and crashes.
Vulnerability Detail
CVE-2025-21961 is a vulnerability in the Linux kernel's bnxt driver, where the truesize of packets is incorrectly calculated when using the mb-xdp feature with XDP_PASS. This miscalculation occurs because the skb_shared_info structure is wiped before the truesize is determined, leading to potential memory corruption and system crashes. The vulnerability can be exploited by sending specially crafted packets, which may cause the kernel to enter an invalid state, resulting in a crash or unexpected behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the mb-xdp feature or refrain from using the XDP_PASS return code in your network configurations until the kernel is updated. To reproduce the issue for testing, you can use the following commands:
<Node A> ip link set $interface1 xdp obj xdp_pass.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interface2 mtu 9000 up ip a a 10.0.0.2/24 dev $interface2 ping 10.0.0.1 -s 65000Conclusion
CVE-2025-21961 is a critical vulnerability in the Linux kernel that affects the bnxt driver, leading to potential system crashes due to incorrect packet size calculations. It is essential to update to the patched version of the kernel to mitigate this risk. Users can also utilize tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21961 is a vulnerability in the Linux kernel's bnxt driver that affects packet size calculations, potentially leading to system crashes.
You can use tools like Vulert to check if your application is affected by this vulnerability without needing to access the code directly.
Exploiting this vulnerability can lead to memory corruption, system instability, and crashes, affecting the overall reliability of the system.
You can update your Linux kernel using package management commands specific to your distribution, such as 'sudo apt-get update && sudo apt-get install linux=<version>' for Debian-based systems.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
