CVE-2025-21922

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ppp: Fix KMSAN uninit-value warning with bpf

Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the

ppp driver not initializing a 2-byte header when using socket filter.

The following code can generate a PPP filter BPF program:

'''

struct bpf_program fp;

pcap_t *handle;

handle = pcap_open_dead(DLT_PPP_PPPD, 65535);

pcap_compile(handle, &fp, "ip and outbound", 0, 0);

bpf_dump(&fp, 1);

'''

Its output is:

'''

(000) ldh [2]

(001) jeq #0x21 jt 2 jf 5

(002) ldb [0]

(003) jeq #0x1 jt 4 jf 5

(004) ret #65535

(005) ret #0

'''

Wen can find similar code at the following link:

https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680

The maintainer of this code repository is also the original maintainer

of the ppp driver.

As you can see the BPF program skips 2 bytes of data and then reads the

'Protocol' field to determine if it's an IP packet. Then it read the first

byte of the first 2 bytes to de

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References