{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21788", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.766Z", "datePublished": "2025-02-27T02:18:27.336Z", "dateUpdated": "2026-08-05T11:54:25.991Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:25.991Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases\n\nIf the XDP program doesn't result in XDP_PASS then we leak the\nmemory allocated by am65_cpsw_build_skb().\n\nIt is pointless to allocate SKB memory before running the XDP\nprogram as we would be wasting CPU cycles for cases other than XDP_PASS.\nMove the SKB allocation after evaluating the XDP program result.\n\nThis fixes the memleak. A performance boost is seen for XDP_DROP test.\n\nXDP_DROP test:\nBefore: 460256 rx/s 0 err/s\nAfter: 784130 rx/s 0 err/s" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The leak is triggered entirely by frames arriving on the am65-cpsw ethernet RX path and processed by the XDP hook, with no local access required. Routed IP traffic from any remote host reaches the driver's receive path, so the vector is Network.\nAC:L - The attacker reliably controls the trigger by sending packets the deployed XDP program will not pass (the canonical XDP_DROP filtering deployment), and every such packet deterministically leaks an sk_buff. No race, no unpredictable memory layout, and no condition outside the attacker's influence is involved.\nPR:N - The vulnerable code runs in the NAPI receive handler before any protocol processing, authentication, or socket ownership check. An unauthenticated remote sender needs no credentials on the target at all.\nUI:N - The leak occurs automatically during packet reception in softirq context. No action by any local user or administrator is needed once the interface is up.\nS:U - The leaked memory and the resulting exhaustion are confined to the kernel of the affected host, with no crossing of a virtualization, IOMMU, or sandbox boundary. The vulnerable component and the impacted component share the same security authority.\nC:N - The orphaned sk_buff is simply never freed; nothing reads it back and no kernel data is exposed to the attacker. There is no out-of-bounds read, uninitialized-memory disclosure, or pointer leak.\nI:N - No memory is overwritten, no adjacent object is corrupted, and no attacker-controlled data alters kernel state. The failure is purely a missed kfree with no write primitive.\nA:H - The leak is unbounded and remotely driven at line rate — the commit's own benchmark implies roughly 100 MB/s of unreclaimable slab — which exhausts RAM on the embedded/industrial platforms this driver targets within seconds, causing OOM kills, hangs, and loss of the system. This is total denial of service by an unauthenticated attacker, not mere performance degradation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/ti/am65-cpsw-nuss.c" ], "versions": [ { "version": "8acacc40f7337527ff84cd901ed2ef0a2b95b2b6", "lessThan": "1bba1d042107167164a0ae3a843fdf650ab005d7", "status": "affected", "versionType": "git" }, { "version": "8acacc40f7337527ff84cd901ed2ef0a2b95b2b6", "lessThan": "dc11f049612b9d926aca2e55f8dc9d82850d0da3", "status": "affected", "versionType": "git" }, { "version": "8acacc40f7337527ff84cd901ed2ef0a2b95b2b6", "lessThan": "5db843258de1e4e6b1ef1cbd1797923c9e3de548", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/ti/am65-cpsw-nuss.c" ], "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.16", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.4", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.13.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1bba1d042107167164a0ae3a843fdf650ab005d7" }, { "url": "https://git.kernel.org/stable/c/dc11f049612b9d926aca2e55f8dc9d82850d0da3" }, { "url": "https://git.kernel.org/stable/c/5db843258de1e4e6b1ef1cbd1797923c9e3de548" } ], "title": "net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-21788", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T19:30:00.916275Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:36:39.866Z" } } ] } }