CVE-2025-21867

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's data that didn't contain an Ethernet header. This occurs when bpf_prog_test_run_xdp() passes an invalid value as the user_data argument to bpf_test_init(). Fix this by returning an error when user_data is less than ETH_HLEN in bpf_test_init(). Additionally, remove the check for "if (user_size > size)" as it is unnecessary. [1] BUG: KMS...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= be3d72a2896cb24090f268dce4aa8a304d40bc23 < f615fccfc689cb48977d275ac2e391297b52392b, >= be3d72a2896cb24090f268dce4aa8a304d40bc23 < d56d8a23d95100b65f40438639dd82db2af81c11, >= be3d72a2896cb24090f268dce4aa8a304d40bc23 < 972bafed67ca73ad9a56448384281eb5fd5c0ba3, >= be3d72a2896cb24090f268dce4aa8a304d40bc23 < 1a9e1284e87d59b1303b69d1808d310821d6e5f7, >= be3d72a2896cb24090f268dce4aa8a304d40bc23 < 6b3d638ca897e099fa99bd6d02189d3176f80a47, >= 5.18, >= V3.1.6, >= 5.18 < 6.1.130, >= 6.2 < 6.6.80, >= 6.7 < 6.12.17, >= 6.13 < 6.13.5, 6.14

Fixed versions

6.1.130, 6.6.80, 6.12.17, 6.13.5

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416