CVE-2025-22075

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rtnetlink: Allocate vfinfo size for VF GUIDs when supported<br /> <br /> Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs")<br /> added support for getting VF port and node GUIDs in netlink ifinfo<br /> messages, but their size was not taken into consideration in the<br /> function that allocates the netlink message, causing the following<br /> warning when a netlink message is filled with many VF port and node<br /> GUIDs:<br /> # echo 64 &gt; /sys/bus/pci/devices/0000\:08\:00.0/sriov_numvfs<br /> # ip link show dev ib0<br /> RTNETLINK answers: Message too long<br /> Cannot send link get request: Message too long<br /> <br /> Kernel warning:<br /> <br /> ------------[ cut here ]------------<br /> WARNING: CPU: 2 PID: 1930 at net/core/rtnetlink.c:4151 rtnl_getlink+0x586/0x5a0<br /> Modules linked in: xt_conntrack xt_MASQUERADE nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay mlx5_ib macsec mlx5_core tls rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm iw_cm ib_ipoib fuse ib_cm ib_core<br /> CPU: 2 UID: 0 PID: 1930 Comm: ip Not tainted 6.14.0-rc2+ #1<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014<br /> RIP: 0010:rtnl_getlink+0x586/0x5a0<br /> Code: cb 82 e8 3d af 0a 00 4d 85 ff 0f 84 08 ff ff ff 4c 89 ff 41 be ea ff ff ff e8 66 63 5b ff 49 c7 07 80 4f cb 82 e9 36 fc ff ff 0b e9 16 fe ff ff e8 de a0 56 00 66 66 2e 0f 1f 84 00 00 00 00<br /> RSP: 0018:ffff888113557348 EFLAGS: 00010246<br /> RAX: 00000000ffffffa6 RBX: ffff88817e87aa34 RCX: dffffc0000000000<br /> RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff88817e87afb8<br /> RBP: 0000000000000009 R08: ffffffff821f44aa R09: 0000000000000000<br /> R10: ffff8881260f79a8 R11: ffff88817e87af00 R12: ffff88817e87aa00<br /> R13: ffffffff8563d300 R14: 00000000ffffffa6 R15: 00000000ffffffff<br /> FS: 00007f63a5dbf280(0000) GS:ffff88881ee00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 00007f63a5ba4493 CR3: 00000001700fe002 CR4: 0000000000772eb0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> ? __warn+0xa5/0x230<br /> ? rtnl_getlink+0x586/0x5a0<br /> ? report_bug+0x22d/0x240<br /> ? handle_bug+0x53/0xa0<br /> ? exc_invalid_op+0x14/0x50<br /> ? asm_exc_invalid_op+0x16/0x20<br /> ? skb_trim+0x6a/0x80<br /> ? rtnl_getlink+0x586/0x5a0<br /> ? __pfx_rtnl_getlink+0x10/0x10<br /> ? rtnetlink_rcv_msg+0x1e5/0x860<br /> ? __pfx___mutex_lock+0x10/0x10<br /> ? rcu_is_watching+0x34/0x60<br /> ? __pfx_lock_acquire+0x10/0x10<br /> ? stack_trace_save+0x90/0xd0<br /> ? filter_irq_stacks+0x1d/0x70<br /> ? kasan_save_stack+0x30/0x40<br /> ? kasan_save_stack+0x20/0x40<br /> ? kasan_save_track+0x10/0x30<br /> rtnetlink_rcv_msg+0x21c/0x860<br /> ? entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> ? __pfx_rtnetlink_rcv_msg+0x10/0x10<br /> ? arch_stack_walk+0x9e/0xf0<br /> ? rcu_is_watching+0x34/0x60<br /> ? lock_acquire+0xd5/0x410<br /> ? rcu_is_watching+0x34/0x60<br /> netlink_rcv_skb+0xe0/0x210<br /> ? __pfx_rtnetlink_rcv_msg+0x10/0x10<br /> ? __pfx_netlink_rcv_skb+0x10/0x10<br /> ? rcu_is_watching+0x34/0x60<br /> ? __pfx___netlink_lookup+0x10/0x10<br /> ? lock_release+0x62/0x200<br /> ? netlink_deliver_tap+0xfd/0x290<br /> ? rcu_is_watching+0x34/0x60<br /> ? lock_release+0x62/0x200<br /> ? netlink_deliver_tap+0x95/0x290<br /> netlink_unicast+0x31f/0x480<br /> ? __pfx_netlink_unicast+0x10/0x10<br /> ? rcu_is_watching+0x34/0x60<br /> ? lock_acquire+0xd5/0x410<br /> netlink_sendmsg+0x369/0x660<br /> ? lock_release+0x62/0x200<br /> ? __pfx_netlink_sendmsg+0x10/0x10<br /> ? import_ubuf+0xb9/0xf0<br /> ? __import_iovec+0x254/0x2b0<br /> ? lock_release+0x62/0x200<br /> ? __pfx_netlink_sendmsg+0x10/0x10<br /> ____sys_sendmsg+0x559/0x5a0<br /> ? __pfx_____sys_sendmsg+0x10/0x10<br /> ? __pfx_copy_msghdr_from_user+0x10/0x10<br /> ? rcu_is_watching+0x34/0x60<br /> ? do_read_fault+0x213/0x4a0<br /> ? rcu_is_watching+0x34/0x60<br /> ___sys_sendmsg+0xe4/0x150<br /> ? __pfx____sys_sendmsg+0x10/0x10<br /> ? do_fault+0x2cc/0x6f0<br /> ? handle_pte_fault+0x2e3/0x3d0<br /> ? __pfx_handle_pte_fault+0x10/0x10<br /> ---truncated---