CVE-2025-22105

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bonding: check xdp prog when set bond mode

Following operations can trigger a warning[1]:

ip netns add ns1

ip netns exec ns1 ip link add bond0 type bond mode balance-rr

ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp

ip netns exec ns1 ip link set bond0 type bond mode broadcast

ip netns del ns1

When delete the namespace, dev_xdp_uninstall() is called to remove xdp

program on bond dev, and bond_xdp_set() will check the bond mode. If bond

mode is changed after attaching xdp program, the warning may occur.

Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode

with xdp program attached is not good. Add check for xdp program when set

bond mode.

[1]

------------[ cut here ]------------

WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930

Modules linked in:

CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References