CVE-2025-21868

一、漏洞信息
 漏洞编号：[CVE-2025-21868](https://nvd.nist.gov/vuln/detail/CVE-2025-21868)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net: allow small head cache usage with large MAX_SKB_FRAGS valuesSabrina reported the following splat:    WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0    Modules linked in:    CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014    RIP: 0010:netif_napi_add_weight_locked+0x8f2/0xba0    Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe <0f> 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48    RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293    RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e    RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6    RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c    R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168    R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007    FS:  0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400    Call Trace:    <TASK>    gro_cells_init+0x1ba/0x270    xfrm_input_init+0x4b/0x2a0    xfrm_init+0x38/0x50    ip_rt_init+0x2d7/0x350    ip_init+0xf/0x20    inet_init+0x406/0x590    do_one_initcall+0x9d/0x2e0    do_initcalls+0x23b/0x280    kernel_init_freeable+0x445/0x490    kernel_init+0x20/0x1d0    ret_from_fork+0x46/0x80    ret_from_fork_asm+0x1a/0x30    </TASK>    irq event stamp: 584330    hardirqs last  enabled at (584338): [<ffffffff8168bf87>] __up_console_sem+0x77/0xb0    hardirqs last disabled at (584345): [<ffffffff8168bf6c>] __up_console_sem+0x5c/0xb0    softirqs last  enabled at (583242): [<ffffffff833ee96d>] netlink_insert+0x14d/0x470    softirqs last disabled at (583754): [<ffffffff8317c8cd>] netif_napi_add_weight_locked+0x77d/0xba0on kernel built with MAX_SKB_FRAGS=45, where SKB_WITH_OVERHEAD(1024)is smaller than GRO_MAX_HEAD.Such built additionally contains the revert of the single page frag cacheso that napi_get_frags() ends up using the page frag allocator, triggeringthe splat.Note that the underlying issue is independent from the mentionedrevert; address it ensuring that the small head cache will fit either TCPand GRO allocation and updating napi_alloc_skb() and __netdev_alloc_skb()to select kmalloc() usage for any allocation fitting such cache.
 漏洞公开时间：2025-03-27 22:15:47
 漏洞创建时间：2025-03-27 22:32:50
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21868
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/14ad6ed30a10afbe91b0749d6378285f4225d482 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/648e440c98e260dec835e48a5d7a9993477b1f9d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ed0ca7d2127c63991cfaf1932b827e3f4f8ee480 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21868 | https://bugzilla.suse.com/show_bug.cgi?id=1240180 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21868.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1240180 |
| suse_bugzilla | https://git.kernel.org/stable/c/ed0ca7d2127c63991cfaf1932b827e3f4f8ee480 | https://bugzilla.suse.com/show_bug.cgi?id=1240180 |
| suse_bugzilla | https://git.kernel.org/stable/c/648e440c98e260dec835e48a5d7a9993477b1f9d | https://bugzilla.suse.com/show_bug.cgi?id=1240180 |
| suse_bugzilla | https://git.kernel.org/stable/c/14ad6ed30a10afbe91b0749d6378285f4225d482 | https://bugzilla.suse.com/show_bug.cgi?id=1240180 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21868 | https://bugzilla.suse.com/show_bug.cgi?id=1240180 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-21868 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 6.12.17 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ed0ca7d2127c63991cfaf1932b827e3f4f8ee480Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3948b05950fdd64002a5f182c65ba5cf2d53cf71 | linuxkernelcves |
| linux_kernel | 6.13.5 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=648e440c98e260dec835e48a5d7a9993477b1f9dIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3948b05950fdd64002a5f182c65ba5cf2d53cf71 | linuxkernelcves |
| linux_kernel | 6.14 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=14ad6ed30a10afbe91b0749d6378285f4225d482Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3948b05950fdd64002a5f182c65ba5cf2d53cf71 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net: allow small head cache usage with large MAX_SKB_FRAGS valuesSabrina reported the following splat:    WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0    Modules linked in:    CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014    RIP: 0010:netif_napi_add_weight_locked+0x8f2/0xba0    Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe &lt;0f&gt; 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48    RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293    RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e    RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6    RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c    R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168    R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007    FS:  0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400    Call Trace:    &lt;TASK&gt;    gro_cells_init+0x1ba/0x270    xfrm_input_init+0x4b/0x2a0    xfrm_init+0x38/0x50    ip_rt_init+0x2d7/0x350    ip_init+0xf/0x20    inet_init+0x406/0x590    do_one_initcall+0x9d/0x2e0    do_initcalls+0x23b/0x280    kernel_init_freeable+0x445/0x490    kernel_init+0x20/0x1d0    ret_from_fork+0x46/0x80    ret_from_fork_asm+0x1a/0x30    &lt;/TASK&gt;    irq event stamp: 584330    hardirqs last  enabled at (584338): [&lt;ffffffff8168bf87&gt;] __up_console_sem+0x77/0xb0    hardirqs last disabled at (584345): [&lt;ffffffff8168bf6c&gt;] __up_console_sem+0x5c/0xb0    softirqs last  enabled at (583242): [&lt;ffffffff833ee96d&gt;] netlink_insert+0x14d/0x470    softirqs last disabled at (583754): [&lt;ffffffff8317c8cd&gt;] netif_napi_add_weight_locked+0x77d/0xba0on kernel built with MAX_SKB_FRAGS=45, where SKB_WITH_OVERHEAD(1024)is smaller than GRO_MAX_HEAD.Such built additionally contains the revert of the single page frag cacheso that napi_get_frags() ends up using the page frag allocator, triggeringthe splat.Note that the underlying issue is independent from the mentionedrevert; address it ensuring that the small head cache will fit either TCPand GRO allocation and updating napi_alloc_skb() and __netdev_alloc_skb()to select kmalloc() usage for any allocation fitting such cache.The Linux kernel CVE team has assigned CVE-2025-21868 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-24.03-LTS-SP1(6.6.0):受影响
3.openEuler-24.03-LTS-SP2(6.6.0):受影响
4.master:不受影响
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响
6.openEuler-22.03-LTS-SP3(5.10.0):不受影响
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master:否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.master:不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2004

src-openEuler/kernel

内容风险标识

评论 (7)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-21868

评论 (7)

搜索帮助

src-openEuler/kernel