Executive brief
A vulnerability in the Linux kernel's network monitoring component could allow a local user to crash the system. The issue occurs because the system attempts to use certain internal security locks before they have been properly set up during the startup process. This can lead to a kernel panic or system instability, impacting the availability of the server or workstation.
Technical details
A race condition exists in the 'drop_monitor' module of the Linux kernel due to an incorrect initialization order. When the module is loaded, it registers its generic netlink family before initializing per-CPU resources and spinlocks. A local attacker or automated tool (like Syzkaller) can send a 'NET_DM_CMD_START' netlink message immediately after registration but before initialization is complete. This triggers 'net_dm_monitor_start()', which attempts to acquire an uninitialized spinlock ('bad magic'), resulting in a kernel BUG and system crash. The fix reorders the initialization sequence to ensure all resources are ready before the netlink interface is exposed.
Affected products
- Linux Linux Kernel 2.6.30 to 6.1.130, 6.2 to 6.6.80, 6.7 to 6.12.17, 6.13 to 6.13.5
Timeline
- 2025-02-13: disclosed: Vulnerability reported by InfoTeCS via Syzkaller
- 2025-02-17: patched: Patch committed to mainline kernel
- 2025-03-12: advisory: CVE-2025-21862 published
References
- https://git.kernel.org/stable/c/07b598c0e6f06a0f254c88dafb4ad50f8a8c6eea
- https://git.kernel.org/stable/c/0efa6c42f81c60d8f72ba7f5ed8d4fec8c526282
- https://git.kernel.org/stable/c/219a47d0e6195bd202f22855e35f25bd15bc4d58
- https://git.kernel.org/stable/c/29f9cdcab3d96d5207a5c92b52c40ad75e5915d8
- https://git.kernel.org/stable/c/6e9e0f224ffd8b819da3ea247dda404795fdd182
- https://git.kernel.org/stable/c/872c7c7e57a746046796ddfead529c9d37b9f6b4
- https://git.kernel.org/stable/c/b7859e8643e75619b2705b4fcac93ffd94d72b4a