VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Feb 27, 2025· Updated May 12, 2026

CVE-2025-21806

CVE-2025-21806

Description

In the Linux kernel, the following vulnerability has been resolved:

net: let net.core.dev_weight always be non-zero

The following problem was encountered during stability test:

(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ cut here ]------------ list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ next=ffff88905f746e40. WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ __list_add_valid_or_report+0xf3/0x130 CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ RIP: 0010:__list_add_valid_or_report+0xf3/0x130 Call Trace: ? __warn+0xcd/0x250 ? __list_add_valid_or_report+0xf3/0x130 enqueue_to_backlog+0x923/0x1070 netif_rx_internal+0x92/0x2b0 __netif_rx+0x15/0x170 loopback_xmit+0x2ef/0x450 dev_hard_start_xmit+0x103/0x490 __dev_queue_xmit+0xeac/0x1950 ip_finish_output2+0x6cc/0x1620 ip_output+0x161/0x270 ip_push_pending_frames+0x155/0x1a0 raw_sendmsg+0xe13/0x1550 __sys_sendto+0x3bf/0x4e0 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x5b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

The reproduction command is as follows: sysctl -w net.core.dev_weight=0 ping 127.0.0.1

This is because when the napi's weight is set to 0, process_backlog() may return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this napi to be re-polled in net_rx_action() until __do_softirq() times out. Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can be retriggered in enqueue_to_backlog(), causing this issue.

Making the napi's weight always non-zero solves this problem.

Triggering this issue requires system-wide admin (setting is not namespaced).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Linux kernel vulnerability allows use-after-free or list corruption when net.core.dev_weight is set to 0, triggered by local admin via ping to loopback.

Vulnerability

CVE-2025-21806 is a vulnerability in the Linux kernel's network stack. The root cause is that the kernel allows the net.core.dev_weight sysctl to be set to 0. When this weight is zero, the NAPI poll function process_backlog() may return 0, which incorrectly clears the NAPI_STATE_SCHED flag on the NAPI structure. This opens the door to a race condition where the NAPI can be re-queued through napi_schedule_rps() while it is already in the process of being polled, leading to a corrupted doubly-linked list and a kernel crash (list_add double add warning)[1][2].

Exploitation

The vulnerability is triggered by a local user with system-wide administrative privileges (CAP_NET_ADMIN or root) setting the sysctl parameter net.core.dev_weight=0 and then sending network traffic (for example, ping 127.0.0.1) to the loopback interface[1]. The attack is not namespaced, so it cannot be performed from within a non-privileged container or user namespace. No special network access is required beyond the ability to run sysctl as root and generate local traffic.

Impact

Successful exploitation causes a kernel panic due to a corrupted linked list in the backlog queue, resulting in a denial of service (DoS) on the affected system. The crash manifests as a WARNING trace in __list_add_valid_or_report followed by a system halt or reboot[1]. The CVSS v3 base score of 5.5 reflects a medium severity, as it requires local admin access but can reliably crash the system.

Mitigation

The fix has been applied in the Linux kernel source repository (commits 6ce38b5a6a49 and 0e2f1d93d287)[3][4] and is included in stable kernel updates. The patch ensures that dev_weight is always non-zero, preventing the impossible budget of 0 from causing the NAPI state corruption. Users should update their kernel to a version containing the fix or, as a workaround, ensure net.core.dev_weight is never set to 0. Siemens has listed this CVE as affecting the SIMATIC S7-1500 TM MFP GNU/Linux subsystem and recommends updating when fix versions become available[1].

References
  1. SSA-265688
  2. SSA-503939
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

163

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.