Log in Start free

Vulnerability · Published Feb 27, 2025 · Assigned by Linux

CVE-2025-21808net: xdp: Disallow attaching device-bound programs in generic mode

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 89.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net: xdp: Disallow attaching device-bound programs in generic mode Device-bound programs are used to support RX metadata kfuncs. These kfuncs are driver-specific and rely on the driver context to read the metadata. This means they can't work in generic XDP mode. However, there is no check to disallow such programs from being attached in generic mode, in which case the metadata kfuncs will be called in an invalid context, leading to crashes. Fix this by adding a check to disallow attaching device-bound programs in generic mode.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.13-1DEBIAN-CVE-2025-21808
Debian:14linux6.12.13-1DEBIAN-CVE-2025-21808
Ubuntu:24.04:LTSlinux6.8.0-64.67UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-aws6.8.0-1032.34UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1032.34~22.04.1UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-azure6.8.0-1034.39UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1015.15~24.04.1UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1034.39~22.04.1UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1022.23UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-gcp6.8.0-1033.35UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1015.15~24.04.1UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1033.35~22.04.1UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-gke6.8.0-1028.32UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1015.17UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-hwe-6.116.11.0-26.26~24.04.1UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-64.67~22.04.1UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-ibm6.8.0-1029.29UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1029.29~22.04.1UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-64.67.1UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.116.11.0-1014.15~24.04.1UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-64.67.1~22.04.1UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1031.34UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1010.10UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1031.34~22.04.1UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1031.34.1UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1008.8UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1022.22UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1031.31UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-oracle6.8.0-1029.30UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1029.30~22.04.1UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-raspi6.8.0-1031.35UBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-64.67~22.04.1UBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-21808
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-21808
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2025-21808

Affected products (as reported)

VendorProductVersions
Linux Linux 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 – before b1bc4a35a04cbeb85b6ef5911ec015baa424989f2b3486bc2d237ec345b3942b7be5deabf8c8fed1 – before 557707906dd3e34b8a8c265f664d19f95799937e2b3486bc2d237ec345b3942b7be5deabf8c8fed1 – before 5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e12b3486bc2d237ec345b3942b7be5deabf8c8fed1 – before 3595599fa8360bb3c7afa7ee50c810b4a64106ea
Linux Linux 6.3

References