CVE-2025-21716

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix uninit-value in vxlan_vnifilter_dump()

KMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1].

If the length of the netlink message payload is less than

sizeof(struct tunnel_msg), vxlan_vnifilter_dump() accesses bytes

beyond the message. This can lead to uninit-value access. Fix this by

returning an error in such situations.

[1]

BUG: KMSAN: uninit-value in vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422

vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422

rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6786

netlink_dump+0x93e/0x15f0 net/netlink/af_netlink.c:2317

__netlink_dump_start+0x716/0xd60 net/netlink/af_netlink.c:2432

netlink_dump_start include/linux/netlink.h:340 [inline]

rtnetlink_dump_start net/core/rtnetlink.c:6815 [inline]

rtnetlink_rcv_msg+0x1256/0x14a0 net/core/rtnetlink.c:6882

netlink_rcv_skb+0x467/0x660 net/netlink/af_netlink.c:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References