CVE-2025-21867

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()<br /> <br /> KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The<br /> cause of the issue was that eth_skb_pkt_type() accessed skb&amp;#39;s data<br /> that didn&amp;#39;t contain an Ethernet header. This occurs when<br /> bpf_prog_test_run_xdp() passes an invalid value as the user_data<br /> argument to bpf_test_init().<br /> <br /> Fix this by returning an error when user_data is less than ETH_HLEN in<br /> bpf_test_init(). Additionally, remove the check for "if (user_size &gt;<br /> size)" as it is unnecessary.<br /> <br /> [1]<br /> BUG: KMSAN: use-after-free in eth_skb_pkt_type include/linux/etherdevice.h:627 [inline]<br /> BUG: KMSAN: use-after-free in eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165<br /> eth_skb_pkt_type include/linux/etherdevice.h:627 [inline]<br /> eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165<br /> __xdp_build_skb_from_frame+0x5a8/0xa50 net/core/xdp.c:635<br /> xdp_recv_frames net/bpf/test_run.c:272 [inline]<br /> xdp_test_run_batch net/bpf/test_run.c:361 [inline]<br /> bpf_test_run_xdp_live+0x2954/0x3330 net/bpf/test_run.c:390<br /> bpf_prog_test_run_xdp+0x148e/0x1b10 net/bpf/test_run.c:1318<br /> bpf_prog_test_run+0x5b7/0xa30 kernel/bpf/syscall.c:4371<br /> __sys_bpf+0x6a6/0xe20 kernel/bpf/syscall.c:5777<br /> __do_sys_bpf kernel/bpf/syscall.c:5866 [inline]<br /> __se_sys_bpf kernel/bpf/syscall.c:5864 [inline]<br /> __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:5864<br /> x64_sys_call+0x2ea0/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:322<br /> do_syscall_x64 arch/x86/entry/common.c:52 [inline]<br /> do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> Uninit was created at:<br /> free_pages_prepare mm/page_alloc.c:1056 [inline]<br /> free_unref_page+0x156/0x1320 mm/page_alloc.c:2657<br /> __free_pages+0xa3/0x1b0 mm/page_alloc.c:4838<br /> bpf_ringbuf_free kernel/bpf/ringbuf.c:226 [inline]<br /> ringbuf_map_free+0xff/0x1e0 kernel/bpf/ringbuf.c:235<br /> bpf_map_free kernel/bpf/syscall.c:838 [inline]<br /> bpf_map_free_deferred+0x17c/0x310 kernel/bpf/syscall.c:862<br /> process_one_work kernel/workqueue.c:3229 [inline]<br /> process_scheduled_works+0xa2b/0x1b60 kernel/workqueue.c:3310<br /> worker_thread+0xedf/0x1550 kernel/workqueue.c:3391<br /> kthread+0x535/0x6b0 kernel/kthread.c:389<br /> ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:147<br /> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244<br /> <br /> CPU: 1 UID: 0 PID: 17276 Comm: syz.1.16450 Not tainted 6.12.0-05490-g9bb88c659673 #8<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014