CVE-2025-21925

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

llc: do not use skb_get() before dev_queue_xmit()

syzbot is able to crash hosts [1], using llc and devices

not supporting IFF_TX_SKB_SHARING.

In this case, e1000 driver calls eth_skb_pad(), while

the skb is shared.

Simply replace skb_get() by skb_clone() in net/llc/llc_s_ac.c

Note that e1000 driver might have an issue with pktgen,

because it does not clear IFF_TX_SKB_SHARING, this is an

orthogonal change.

We need to audit other skb_get() uses in net/llc.

[1]

kernel BUG at net/core/skbuff.c:2178 !

Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI

CPU: 0 UID: 0 PID: 16371 Comm: syz.2.2764 Not tainted 6.14.0-rc4-syzkaller-00052-gac9c34d1e45a #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014

RIP: 0010:pskb_expand_head+0x6ce/0x1240 net/core/skbuff.c:2178

Call Trace:

<TASK>

__skb_pad+0x18a/0x610 net/core/skbuff.c:2466

__skb_put_padto include/linux/skbuff

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References