Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

CVE-2025-21676— net: fec: handle page_pool_dev_alloc_pages error

EPSS 0.02% · P5

Affected Version Matrix 10

VendorProductVersion RangeStatus
LinuxLinux95698ff6177b5f1f13f251da60e7348413046ae4< eacdcc14f3c8d4c1447565521e792ddb3a67e08daffected
95698ff6177b5f1f13f251da60e7348413046ae4< 8a0097db0544b658c159ac787319737712063a23affected
95698ff6177b5f1f13f251da60e7348413046ae4< 1425cb829556398f594658512d49292f988a2ab0affected
95698ff6177b5f1f13f251da60e7348413046ae4< 001ba0902046cb6c352494df610718c0763e77a5affected
6.1affected
< 6.1unaffected
6.1.167≤ 6.1.*unaffected
6.6.74≤ 6.6.*unaffected
… +2 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-21676

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: fec: handle page_pool_dev_alloc_pages error
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd function calls page_pool_dev_alloc_pages but did not handle the case when it returned NULL. There was a WARN_ON(!new_page) but it would still proceed to use the NULL pointer and then crash. This case does seem somewhat rare but when the system is under memory pressure it can happen. One case where I can duplicate this with some frequency is when writing over a smbd share to a SATA HDD attached to an imx6q. Setting /proc/sys/vm/min_free_kbytes to higher values also seems to solve the problem for my test case. But it still seems wrong that the fec driver ignores the memory allocation error and can crash. This commit handles the allocation error by dropping the current packet.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在代码问题漏洞，该漏洞源于fec_enet_update_cbd函数调用page_pool_dev_alloc_pages时未正确处理返回NULL的情况。当系统内存压力较大时，可能会导致系统崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 95698ff6177b5f1f13f251da60e7348413046ae4 ~ eacdcc14f3c8d4c1447565521e792ddb3a67e08d -
LinuxLinux 6.1 -

II. Public POCs for CVE-2025-21676

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21676

请登录查看更多情报信息。
Patch · 4

Same Patch Batch · Linux · 2025-01-31 · 20 CVEs total

CVE-2025-21673smb: client: fix double free of TCP_Server_Info::hostname
CVE-2024-57948mac802154: check local interfaces before deleting sdata list
CVE-2025-21665filemap: avoid truncating 64-bit offset to 32 bits
CVE-2025-21666vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
CVE-2025-21667iomap: avoid avoid truncating 64-bit offset to 32 bits
CVE-2025-21668pmdomain: imx8mp-blk-ctrl: add missing loop break condition
CVE-2025-21669vsock/virtio: discard packets if the transport changes
CVE-2025-21670vsock/bpf: return early if transport is not assigned
CVE-2025-21671zram: fix potential UAF of zram table
CVE-2025-21672afs: Fix merge preference rule failure condition
CVE-2025-21683bpf: Fix bpf_sk_select_reuseport() memory leak
CVE-2025-21674net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel
CVE-2025-21675net/mlx5: Clear port select structure when fail to create
CVE-2025-21677pfcp: Destroy device along with udp socket's netns dismantle.
CVE-2025-21679btrfs: add the missing error handling inside get_canonical_dev_path
CVE-2025-21678gtp: Destroy device along with udp socket's netns dismantle.
CVE-2025-21681openvswitch: fix lockup on tx to unregistering netdev with carrier
CVE-2025-21680pktgen: Avoid out-of-bounds access in get_imix_entries
CVE-2025-21682eth: bnxt: always recalculate features after XDP clearing, fix null-deref

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21676

No comments yet

Leave a comment