Executive brief
A vulnerability in the Linux kernel's networking component could allow a system administrator to inadvertently crash the system. By setting a specific networking parameter (dev_weight) to zero, the system's packet processing mechanism enters an unstable state that leads to a kernel crash. This results in a complete loss of system availability, requiring a reboot to restore operations.
Technical details
A vulnerability exists in the Linux kernel networking stack where setting the 'net.core.dev_weight' sysctl parameter to zero causes a kernel panic. When the NAPI weight is zero, the 'process_backlog' function may return 0 and prematurely clear the NAPI_STATE_SCHED bit. This allows 'napi_schedule_rps' to be retriggered in 'enqueue_to_backlog' while the system is still polling, leading to a 'list_add double add' corruption and a subsequent kernel warning or panic. The issue is reachable via local administrative access as the setting is system-wide and not namespaced. Patches have been released across multiple stable kernel branches to enforce a minimum value of one for these sysctl parameters.
Affected products
- Linux Linux Kernel versions from 2.6.12 up to 6.13.2
Timeline
- 2025-01-16: patched: Initial patch submitted by Liu Jian
- 2025-02-27: advisory: CVE-2025-21806 published
References
- https://git.kernel.org/stable/c/0e2f1d93d287d544d26f8ff293ea820a8079b9f8
- https://git.kernel.org/stable/c/1489824e5226a26841c70639ebd2d1aed390764b
- https://git.kernel.org/stable/c/33e2168788f8fb5cb8bd4f36cb1ef37d1d34dada
- https://git.kernel.org/stable/c/5860abbf15eeb61838b5e32e721ba67b0aa84450
- https://git.kernel.org/stable/c/6ce38b5a6a49e65bad163162a54cb3f104c40b48
- https://git.kernel.org/stable/c/c337c08819a4ec49edfdcd8fc46fbee120d8a5b2
- https://git.kernel.org/stable/c/d0e0f9c8218826926d7692980c98236d9f21fd3c