{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21701", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.748Z", "datePublished": "2025-02-13T15:05:46.483Z", "dateUpdated": "2026-08-05T11:53:44.132Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:53:44.132Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: avoid race between device unregistration and ethnl ops\n\nThe following trace can be seen if a device is being unregistered while\nits number of channels are being modified.\n\n DEBUG_LOCKS_WARN_ON(lock->magic != lock)\n WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120\n CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771\n RIP: 0010:__mutex_lock+0xc8a/0x1120\n Call Trace:\n \n ethtool_check_max_channel+0x1ea/0x880\n ethnl_set_channels+0x3c3/0xb10\n ethnl_default_set_doit+0x306/0x650\n genl_family_rcv_msg_doit+0x1e3/0x2c0\n genl_rcv_msg+0x432/0x6f0\n netlink_rcv_skb+0x13d/0x3b0\n genl_rcv+0x28/0x40\n netlink_unicast+0x42e/0x720\n netlink_sendmsg+0x765/0xc20\n __sys_sendto+0x3ac/0x420\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0x95/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThis is because unregister_netdevice_many_notify might run before the\nrtnl lock section of ethnl operations, eg. set_channels in the above\nexample. In this example the rss lock would be destroyed by the device\nunregistration path before being used again, but in general running\nethnl operations while dismantle has started is not a good idea.\n\nFix this by denying any operation on devices being unregistered. A check\nwas already there in ethnl_ops_begin, but not wide enough.\n\nNote that the same issue cannot be seen on the ioctl version\n(__dev_ethtool) because the device reference is retrieved from within\nthe rtnl lock section there. Once dismantle started, the net device is\nunlisted and no reference will be found." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is entered by sending an ethtool generic-netlink message on an AF_NETLINK socket from a local process (`__sys_sendto` → `genl_rcv` → `ethnl_default_set_doit`/`ethnl_default_doit`). Netlink-based subsystem access is Local per kernel scoring guidance.\nAC:L - The attacker controls both sides of the race — creating and deleting veth/dummy devices in a namespace they own while concurrently hammering ethnl GET/SET requests for those ifindexes from other threads — so the window can be hit reliably and repeated indefinitely. Once the device reaches NETREG_UNREGISTERED it stalls in netdev_wait_allrefs_any() on the reference the attacker's own request holds, keeping the window open.\nPR:L - Local access as an ordinary unprivileged user suffices: ethtool netlink GET operations require no capability, and the SET operations' GENL_UNS_ADMIN_PERM resolves to ns_capable(net->user_ns, CAP_NET_ADMIN), which is granted inside an unprivileged user namespace (unshare -Urn) that also lets the attacker create and destroy the netdevices needed for the race.\nUI:N - The attacker drives both the device unregistration and the ethtool netlink requests entirely from their own processes. No victim action or interaction is involved.\nS:U - The corruption and crash occur in kernel memory within the same security authority as the attacking local process. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The ethtool operation proceeds against a device whose teardown has fully completed — rss_lock destroyed, the rss_ctx xarray destroyed and its ethtool_rxfh_context objects freed, ndo_uninit() and NETDEV_UNREGISTER notifiers already run — so reads through this dismantled state can return freed/stale kernel memory to userspace via the netlink reply. This use-after-teardown condition is treated as High per the use-after-free guidance.\nI:H - The ethtool set handlers (set_channels, set_rings, set_coalesce, etc.) perform writes into device and driver structures that have already been torn down, and lock a mutex that has been destroyed, giving an attacker-influenced write into stale kernel state that is exploitable for memory corruption.\nA:H - The reported symptom is a kernel WARNING in __mutex_lock() from locking the destroyed rss_lock, which is fatal on panic_on_warn systems, and operating on a fully dismantled net_device readily leads to oopses and driver-level crashes." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ethtool/netlink.c" ], "versions": [ { "version": "cfd719f04267108f5f5bf802b9d7de69e99a99f9", "lessThan": "26bc6076798aa4dc83a07d0a386f9e57c94e8517", "status": "affected", "versionType": "git" }, { "version": "dde91ccfa25fd58f64c397d91b81a4b393100ffa", "lessThan": "b1cb37a31a482df3dd35a6ac166282dac47664f4", "status": "affected", "versionType": "git" }, { "version": "dde91ccfa25fd58f64c397d91b81a4b393100ffa", "lessThan": "2f29127e94ae9fdc7497331003d6860e9551cdf3", "status": "affected", "versionType": "git" }, { "version": "dde91ccfa25fd58f64c397d91b81a4b393100ffa", "lessThan": "b382ab9b885cbb665e0e70a727f101c981b4edf3", "status": "affected", "versionType": "git" }, { "version": "dde91ccfa25fd58f64c397d91b81a4b393100ffa", "lessThan": "4dc880245f9b529fa8f476b5553c799d2848b47b", "status": "affected", "versionType": "git" }, { "version": "dde91ccfa25fd58f64c397d91b81a4b393100ffa", "lessThan": "12e070eb6964b341b41677fd260af5a305316a1f", "status": "affected", "versionType": "git" }, { "version": "7c26da3be1e9843a15b5318f90db8a564479d2ac", "status": "affected", "versionType": "git" }, { "version": "5.15.8", "lessThan": "5.15.179", "status": "affected", "versionType": "semver" }, { "version": "5.10.87", "lessThan": "5.11", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ethtool/netlink.c" ], "versions": [ { "version": "5.16", "status": "affected" }, { "version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.8", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.129" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.87" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/26bc6076798aa4dc83a07d0a386f9e57c94e8517" }, { "url": "https://git.kernel.org/stable/c/b1cb37a31a482df3dd35a6ac166282dac47664f4" }, { "url": "https://git.kernel.org/stable/c/2f29127e94ae9fdc7497331003d6860e9551cdf3" }, { "url": "https://git.kernel.org/stable/c/b382ab9b885cbb665e0e70a727f101c981b4edf3" }, { "url": "https://git.kernel.org/stable/c/4dc880245f9b529fa8f476b5553c799d2848b47b" }, { "url": "https://git.kernel.org/stable/c/12e070eb6964b341b41677fd260af5a305316a1f" } ], "title": "net: avoid race between device unregistration and ethnl ops", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2025-09-02T19:15:24.731894Z", "id": "CVE-2025-21701", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T19:16:21.196Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:35:47.886Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:39:42.517Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ] } ] } }