CVE-2025-21868

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: allow small head cache usage with large MAX_SKB_FRAGS values<br /> <br /> Sabrina reported the following splat:<br /> <br /> WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0<br /> Modules linked in:<br /> CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014<br /> RIP: 0010:netif_napi_add_weight_locked+0x8f2/0xba0<br /> Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48<br /> RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293<br /> RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e<br /> RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6<br /> RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c<br /> R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168<br /> R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007<br /> FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> Call Trace:<br /> <br /> gro_cells_init+0x1ba/0x270<br /> xfrm_input_init+0x4b/0x2a0<br /> xfrm_init+0x38/0x50<br /> ip_rt_init+0x2d7/0x350<br /> ip_init+0xf/0x20<br /> inet_init+0x406/0x590<br /> do_one_initcall+0x9d/0x2e0<br /> do_initcalls+0x23b/0x280<br /> kernel_init_freeable+0x445/0x490<br /> kernel_init+0x20/0x1d0<br /> ret_from_fork+0x46/0x80<br /> ret_from_fork_asm+0x1a/0x30<br /> <br /> irq event stamp: 584330<br /> hardirqs last enabled at (584338): [] __up_console_sem+0x77/0xb0<br /> hardirqs last disabled at (584345): [] __up_console_sem+0x5c/0xb0<br /> softirqs last enabled at (583242): [] netlink_insert+0x14d/0x470<br /> softirqs last disabled at (583754): [] netif_napi_add_weight_locked+0x77d/0xba0<br /> <br /> on kernel built with MAX_SKB_FRAGS=45, where SKB_WITH_OVERHEAD(1024)<br /> is smaller than GRO_MAX_HEAD.<br /> <br /> Such built additionally contains the revert of the single page frag cache<br /> so that napi_get_frags() ends up using the page frag allocator, triggering<br /> the splat.<br /> <br /> Note that the underlying issue is independent from the mentioned<br /> revert; address it ensuring that the small head cache will fit either TCP<br /> and GRO allocation and updating napi_alloc_skb() and __netdev_alloc_skb()<br /> to select kmalloc() usage for any allocation fitting such cache.