{
  "threat_severity" : "Moderate",
  "public_date" : "2025-03-27T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()",
    "id" : "2355334",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2355334"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nbpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()\nKMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The\ncause of the issue was that eth_skb_pkt_type() accessed skb's data\nthat didn't contain an Ethernet header. This occurs when\nbpf_prog_test_run_xdp() passes an invalid value as the user_data\nargument to bpf_test_init().\nFix this by returning an error when user_data is less than ETH_HLEN in\nbpf_test_init(). Additionally, remove the check for \"if (user_size >\nsize)\" as it is unnecessary.\n[1]\nBUG: KMSAN: use-after-free in eth_skb_pkt_type include/linux/etherdevice.h:627 [inline]\nBUG: KMSAN: use-after-free in eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165\neth_skb_pkt_type include/linux/etherdevice.h:627 [inline]\neth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165\n__xdp_build_skb_from_frame+0x5a8/0xa50 net/core/xdp.c:635\nxdp_recv_frames net/bpf/test_run.c:272 [inline]\nxdp_test_run_batch net/bpf/test_run.c:361 [inline]\nbpf_test_run_xdp_live+0x2954/0x3330 net/bpf/test_run.c:390\nbpf_prog_test_run_xdp+0x148e/0x1b10 net/bpf/test_run.c:1318\nbpf_prog_test_run+0x5b7/0xa30 kernel/bpf/syscall.c:4371\n__sys_bpf+0x6a6/0xe20 kernel/bpf/syscall.c:5777\n__do_sys_bpf kernel/bpf/syscall.c:5866 [inline]\n__se_sys_bpf kernel/bpf/syscall.c:5864 [inline]\n__x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:5864\nx64_sys_call+0x2ea0/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:322\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nUninit was created at:\nfree_pages_prepare mm/page_alloc.c:1056 [inline]\nfree_unref_page+0x156/0x1320 mm/page_alloc.c:2657\n__free_pages+0xa3/0x1b0 mm/page_alloc.c:4838\nbpf_ringbuf_free kernel/bpf/ringbuf.c:226 [inline]\nringbuf_map_free+0xff/0x1e0 kernel/bpf/ringbuf.c:235\nbpf_map_free kernel/bpf/syscall.c:838 [inline]\nbpf_map_free_deferred+0x17c/0x310 kernel/bpf/syscall.c:862\nprocess_one_work kernel/workqueue.c:3229 [inline]\nprocess_scheduled_works+0xa2b/0x1b60 kernel/workqueue.c:3310\nworker_thread+0xedf/0x1550 kernel/workqueue.c:3391\nkthread+0x535/0x6b0 kernel/kthread.c:389\nret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\nCPU: 1 UID: 0 PID: 17276 Comm: syz.1.16450 Not tainted 6.12.0-05490-g9bb88c659673 #8\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014" ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-08-18T00:00:00Z",
    "advisory" : "RHSA-2025:14009",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.0",
    "package" : "kernel-0:6.12.0-55.28.1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-05-09T00:00:00Z",
    "advisory" : "RHSA-2023:2458",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-284.11.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-08-18T00:00:00Z",
    "advisory" : "RHSA-2025:13962",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.35.1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-05-09T00:00:00Z",
    "advisory" : "RHSA-2023:2458",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-284.11.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-08-18T00:00:00Z",
    "advisory" : "RHSA-2025:13962",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.35.1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2025-08-27T00:00:00Z",
    "advisory" : "RHSA-2025:14696",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "kernel-0:5.14.0-284.134.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2025-08-27T00:00:00Z",
    "advisory" : "RHSA-2025:14691",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2::nfv",
    "package" : "kernel-rt-0:5.14.0-284.134.1.rt14.419.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15016",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "kernel-0:5.14.0-427.85.1.el9_4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-21867\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21867\nhttps://lore.kernel.org/linux-cve-announce/2025032732-CVE-2025-21867-3138@gregkh/T" ],
  "name" : "CVE-2025-21867",
  "csaw" : false
}