CVE-2025-21720

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: delete intermediate secpath entry in packet offload mode

Packets handled by hardware have added secpath as a way to inform XFRM

core code that this path was already handled. That secpath is not needed

at all after policy is checked and it is removed later in the stack.

However, in the case of IP forwarding is enabled (/proc/sys/net/ipv4/ip_forward),

that secpath is not removed and packets which already were handled are reentered

to the driver TX path with xfrm_offload set.

The following kernel panic is observed in mlx5 in such case:

mlx5_core 0000:04:00.0 enp4s0f0np0: Link up

mlx5_core 0000:04:00.1 enp4s0f1np1: Link up

Initializing XFRM netlink socket

IPsec XFRM device driver

BUG: kernel NULL pointer dereference, address: 0000000000000000

#PF: supervisor instruction fetch in kernel mode

#PF: error_code(0x0010) - not-present page

PGD 0 P4D 0

Oops: Oops: 0010 [#1] PREEMPT SMP

CPU: 0 UID: 0 PID: 0 Com

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References