CVE-2025-21867

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The

cause of the issue was that eth_skb_pkt_type() accessed skb's data

that didn't contain an Ethernet header. This occurs when

bpf_prog_test_run_xdp() passes an invalid value as the user_data

argument to bpf_test_init().

Fix this by returning an error when user_data is less than ETH_HLEN in

bpf_test_init(). Additionally, remove the check for "if (user_size >

size)" as it is unnecessary.

[1]

BUG: KMSAN: use-after-free in eth_skb_pkt_type include/linux/etherdevice.h:627 [inline]

BUG: KMSAN: use-after-free in eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165

eth_skb_pkt_type include/linux/etherdevice.h:627 [inline]

eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165

__xdp_build_skb_from_frame+0x5a8/0xa50 net/core/xdp.c:635

xdp_recv_frames net/bpf/test_run.c:272 [inline]

xdp_test_run_batch n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References