VYPR
← All advisories
High severity7.8NVD Advisory· Published Mar 12, 2025· Updated May 12, 2026

CVE-2025-21858

CVE-2025-21858

Description

In the Linux kernel, the following vulnerability has been resolved:

geneve: Fix use-after-free in geneve_find_dev().

syzkaller reported a use-after-free in geneve_find_dev() [0] without repro.

geneve_configure() links struct geneve_dev.next to net_generic(net, geneve_net_id)->geneve_list.

The net here could differ from dev_net(dev) if IFLA_NET_NS_PID, IFLA_NET_NS_FD, or IFLA_TARGET_NETNSID is set.

When dev_net(dev) is dismantled, geneve_exit_batch_rtnl() finally calls unregister_netdevice_queue() for each dev in the netns, and later the dev is freed.

However, its geneve_dev.next is still linked to the backend UDP socket netns.

Then, use-after-free will occur when another geneve dev is created in the netns.

Let's call geneve_dellink() instead in geneve_destroy_tunnels().

[0]: BUG: KASAN: slab-use-after-free in geneve_find_dev drivers/net/geneve.c:1295 [inline] BUG: KASAN: slab-use-after-free in geneve_configure+0x234/0x858 drivers/net/geneve.c:1343 Read of size 2 at addr ffff000054d6ee24 by task syz.1.4029/13441

CPU: 1 UID: 0 PID: 13441 Comm: syz.1.4029 Not tainted 6.13.0-g0ad9617c78ac #24 dc35ca22c79fb82e8e7bc5c9c9adafea898b1e3d Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x16c/0x6f0 mm/kasan/report.c:489 kasan_report+0xc0/0x120 mm/kasan/report.c:602 __asan_report_load2_noabort+0x20/0x30 mm/kasan/report_generic.c:379 geneve_find_dev drivers/net/geneve.c:1295 [inline] geneve_configure+0x234/0x858 drivers/net/geneve.c:1343 geneve_newlink+0xb8/0x128 drivers/net/geneve.c:1634 rtnl_newlink_create+0x23c/0x868 net/core/rtnetlink.c:3795 __rtnl_newlink net/core/rtnetlink.c:3906 [inline] rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021 rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:713 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x410/0x6f8 net/socket.c:2568 ___sys_sendmsg+0x178/0x1d8 net/socket.c:2622 __sys_sendmsg net/socket.c:2654 [inline] __do_sys_sendmsg net/socket.c:2659 [inline] __se_sys_sendmsg net/socket.c:2657 [inline] __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2657 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151 el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600

Allocated by task 13247: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x68 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x58 mm/kasan/generic.c:568 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4298 [inline] __kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4304 __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:645 alloc_netdev_mqs+0xb8/0x11a0 net/core/dev.c:11470 rtnl_create_link+0x2b8/0xb50 net/core/rtnetlink.c:3604 rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3780 __rtnl_newlink net/core/rtnetlink.c:3906 [inline] rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021 rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938 netlink_unicast_kernel net/netlink/af_n ---truncated---

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free vulnerability in the Linux kernel's Geneve tunneling driver occurs when a device is moved across network namespaces, leading to potential memory corruption.

Vulnerability

CVE-2025-21858 is a use-after-free bug in the Linux kernel's Geneve (Generic Network Virtualization Encapsulation) tunnel driver. The issue arises in the geneve_configure() function, which adds a geneve_dev structure to a per-net namespace list (geneve_list). However, the namespace used for this list (obtained from net_generic(net, geneve_net_id)) may differ from the device's actual network namespace (dev_net(dev)) when the device is created with namespace attributes like IFLA_NET_NS_PID. If the device's original namespace is dismantled, the device is freed while still linked into the other namespace's list, leading to a use-after-free condition later when the list is traversed, for instance during creation of another Geneve device [1].

Exploitation

An attacker with sufficient privileges (e.g., capable of creating network devices and manipulating network namespaces, often requiring root or CAP_NET_ADMIN) can trigger this vulnerability. By creating a Geneve device that is moved between namespaces, and then causing the original namespace to be dismantled, the dangling list pointer can be accessed. The exploitation occurs when geneve_find_dev() is called (e.g., during configuration of a new Geneve device in the backend UDP socket namespace), as shown by a syzkaller report which detected the bug using a slab-use-after-free read [1]. No specific reproducer was provided, but the bug implies a local attacker on the system may be able to cause a kernel crash or potentially escalate privileges.

Impact

Successful exploitation leads to a slab-use-after-free, which could allow an attacker to corrupt kernel memory. This can cause a denial of service (system crash) and possibly arbitrary code execution (kernel-level privilege escalation), depending on the system's hardening. The CVSS v3 score of 7.8 (High) reflects the high impact on confidentiality, integrity, and availability.

Mitigation

The fix is included in the Linux kernel stable tree via commits [2], [3], and [4]. These patches change geneve_destroy_tunnels() to call geneve_dellink() instead of directly freeing devices, ensuring that the per-net namespace list is properly updated before device removal. Users should update their kernel to a version containing one of these commits. For systems that cannot immediately update, the vulnerability can be avoided by not creating Geneve devices in multi-namespace configurations or by restricting the capability to create such devices. Siemens has also acknowledged the issue as affecting the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, indicating that embedded/industrial systems are at risk [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

93

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.