Junglewise Threat Intelligence

CVE-2025-21669: Linux Kernel NULL pointer dereference in vsock virtio transport

CVE-2025-21669 · Severity: medium · CVSS 5.5 · Published 2025-01-31

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when the system handles specific communication packets (vsock/virtio) after a connection attempt is interrupted. This can lead to a system crash (NULL pointer dereference), impacting the availability of the affected machine or virtual environment.

Technical details

A NULL pointer dereference vulnerability exists in net/vmw_vsock/virtio_transport_common.c within the Linux kernel. The issue occurs when a socket is de-assigned or assigned to a different transport while packets are still being received. Specifically, if a connect() call is interrupted by a signal and a subsequent connect() fails, vsk->transport may be set to NULL. When virtio_transport_recv_pkt() later attempts to access this transport pointer without verifying its state relative to the current transport, it triggers a kernel panic. The fix introduces a check to discard packets if the socket state is not TCP_LISTEN and the assigned transport does not match the expected transport.

Affected products

  • Linux Linux Kernel 5.5 to 5.15.176, 5.16 to 6.1.126, 6.2 to 6.6.73, 6.7 to 6.12.10

Timeline

  • 2025-01-10: patched: Initial patch authored
  • 2025-01-31: disclosed: CVE published

References

Related threats