{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21680","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.738Z","datePublished":"2025-01-31T11:25:40.831Z","dateUpdated":"2026-08-05T11:53:35.511Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:53:35.511Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npktgen: Avoid out-of-bounds access in get_imix_entries\n\nPassing a sufficient amount of imix entries leads to invalid access to the\npkt_dev->imix_entries array because of the incorrect boundary check.\n\nUBSAN: array-index-out-of-bounds in net/core/pktgen.c:874:24\nindex 20 is out of range for type 'imix_pkt [20]'\nCPU: 2 PID: 1210 Comm: bash Not tainted 6.10.0-rc1 #121\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996)\nCall Trace:\n<TASK>\ndump_stack_lvl lib/dump_stack.c:117\n__ubsan_handle_out_of_bounds lib/ubsan.c:429\nget_imix_entries net/core/pktgen.c:874\npktgen_if_write net/core/pktgen.c:1063\npde_write fs/proc/inode.c:334\nproc_reg_write fs/proc/inode.c:346\nvfs_write fs/read_write.c:593\nksys_write fs/read_write.c:644\ndo_syscall_64 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:130\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n[ fp: allow to fill the array completely; minor changelog cleanup ]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable parser is reached only by write(2) to /proc/net/pktgen/<ifname>, requiring local access to the machine. No network-facing path reaches get_imix_entries().\nAC:L - A single deterministic write() of 21 \"size,weight\" pairs triggers the out-of-bounds write every time; there is no race, timing window, or memory-layout condition outside the attacker's control.\nPR:L - pktgen_if_write() and pktgen_thread_write() contain no capable() check at all, and under `unshare -Urn` the /proc/net/pktgen entries inherit the netns owner's uid (proc_net_ns_init sets /proc/net to make_kuid(net->user_ns, 0)), so an ordinary unprivileged user owns the 0600 files in their own namespace.\nUI:N - The attacker performs the entire sequence themselves — create the namespace, add the device, write the imix string — with no action by any other user.\nS:U - The corruption is confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overwritten imix_distribution[] bytes become the array index in mod_cur_headers(), turning the bug into an out-of-bounds read of up to ~6 KB past the pktgen_dev allocation whose contents are echoed back through cur_pkt_size in the /proc output.\nI:H - This is an out-of-bounds write of 16 fully attacker-controlled bytes past imix_entries[], and the resulting corrupted index yields a further OOB increment (entry->count_so_far++) into neighbouring slab objects at an attacker-selected offset.\nA:H - The out-of-bounds access traps under CONFIG_UBSAN_BOUNDS/UBSAN_TRAP (and panics with panic_on_warn), and the stale n_imix_entries=21 plus corrupted distribution drives further OOB accesses and bogus cur_pkt_size values into skb allocation, causing kernel crashes."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/pktgen.c"],"versions":[{"version":"52a62f8603f97e720882c8f5aff2767ac6a11d5f","lessThan":"3450092cc2d1c311c5ea92a2486daa2a33520ea5","status":"affected","versionType":"git"},{"version":"52a62f8603f97e720882c8f5aff2767ac6a11d5f","lessThan":"e5d24a7074dcd0c7e76b7e7e4efbbe7418d62486","status":"affected","versionType":"git"},{"version":"52a62f8603f97e720882c8f5aff2767ac6a11d5f","lessThan":"7cde21f52042aa2e29a654458166b873d2ae66b3","status":"affected","versionType":"git"},{"version":"52a62f8603f97e720882c8f5aff2767ac6a11d5f","lessThan":"1a9b65c672ca9dc4ba52ca2fd54329db9580ce29","status":"affected","versionType":"git"},{"version":"52a62f8603f97e720882c8f5aff2767ac6a11d5f","lessThan":"76201b5979768500bca362871db66d77cb4c225e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/pktgen.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.15.177","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.127","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.74","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.11","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.177"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.127"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.74"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.13"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3450092cc2d1c311c5ea92a2486daa2a33520ea5"},{"url":"https://git.kernel.org/stable/c/e5d24a7074dcd0c7e76b7e7e4efbbe7418d62486"},{"url":"https://git.kernel.org/stable/c/7cde21f52042aa2e29a654458166b873d2ae66b3"},{"url":"https://git.kernel.org/stable/c/1a9b65c672ca9dc4ba52ca2fd54329db9580ce29"},{"url":"https://git.kernel.org/stable/c/76201b5979768500bca362871db66d77cb4c225e"}],"title":"pktgen: Avoid out-of-bounds access in get_imix_entries","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-21680","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-10-01T19:51:54.428740Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-129","description":"CWE-129 Improper Validation of Array Index"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-10-01T19:57:11.468Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T20:58:57.266Z"}}]}}