CVE-2025-21855: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21855 Overview

CVE-2025-21855 is a use-after-free vulnerability [CWE-416] in the Linux kernel's ibmvnic network driver. The flaw exists in the ibmvnic_xmit transmit path, where the driver referenced a socket buffer (skb) after handing it off to the Virtual I/O Server (VIOS). After the buffer is flushed to VIOS, the hypervisor can trigger an interrupt to free the memory at any time. Reading skb->len to update the tx_bytes statistic races with that free operation, producing a slab use-after-free detected by KASAN. The condition is especially likely to occur during Live Partition Mobility (LPM) on IBM Power systems running PowerVM.

Critical Impact
Local attackers with low privileges on affected IBM Power Linux systems can trigger kernel memory corruption, leading to potential privilege escalation, information disclosure, or system crash.

Affected Products

Linux kernel stable branches prior to the fixed commits
Linux kernel 6.14-rc1, 6.14-rc2, and 6.14-rc3
Debian LTS distributions shipping the vulnerable ibmvnic driver

Discovery Timeline

2025-03-12 - CVE-2025-21855 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-21855

Vulnerability Analysis

The ibmvnic driver provides network connectivity for Linux logical partitions (LPARs) running on IBM PowerVM. During packet transmission, the driver submits an skb buffer to VIOS through a hypervisor call. VIOS asynchronously signals completion via an interrupt, at which point the kernel frees the skb through napi_skb_cache_put in the softirq path.

The vulnerability arises because ibmvnic_xmit accessed skb->len after the send call returned successfully in order to increment the tx_bytes statistic. Between the send and the statistic update, VIOS could complete the send and free the buffer. The subsequent read of skb->len then references freed slab memory in the skbuff_head_cache.

KASAN reports confirm the race, showing a 4-byte read at a freed address during ibmvnic_xmit+0x75c. The freeing task path passes through net_tx_action and handle_softirqs, illustrating the classic asymmetric-lifetime pattern between transmit submission and completion handling.

Root Cause

The root cause is improper lifetime management of the skb pointer. The driver assumed the buffer remained valid after transmission to VIOS, but ownership transferred to the hypervisor at the moment of submission. The fix captures skb->len into a local variable before the send call, so statistics can be updated without dereferencing memory that may already be reclaimed.

Attack Vector

Exploitation requires local access with low privileges on an affected IBM Power Linux guest. An attacker generates network transmit load, ideally coinciding with LPM migration events, to reliably widen the race window. Successful exploitation corrupts objects in the skbuff_head_cache slab, which can be leveraged for kernel heap manipulation, information disclosure, or denial of service. No user interaction and no network access is needed.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS probability remains low.

Detection Methods for CVE-2025-21855

Indicators of Compromise

KASAN reports containing slab-use-after-free in ibmvnic_xmit in kernel logs
Unexpected kernel oops or panic entries referencing ibmvnic_xmit+0x75c or skbuff_head_cache
Kernel crashes correlated with PowerVM Live Partition Mobility (LPM) operations on affected LPARs

Detection Strategies

Enable KASAN on non-production kernels running the ibmvnic driver to surface the use-after-free at runtime
Query the running kernel version against the fixed stable commits (093b0e5, 25dddd0, 501ac6a, abaff27, bdf5d13) using package inventory tooling
Correlate dmesg output with LPM events on PowerVM hosts to identify systems exhibiting the race

Monitoring Recommendations

Forward kernel logs (/var/log/kern.log, journalctl -k) to a centralized log platform and alert on KASAN, BUG:, and ibmvnic strings
Track kernel package versions across the IBM Power fleet and flag hosts running vulnerable builds
Monitor unplanned reboots or NIC resets on ibmvnic interfaces as potential exploitation or triggering signals

How to Mitigate CVE-2025-21855

Immediate Actions Required

Apply the vendor-supplied kernel updates from your Linux distribution as soon as they are available
Prioritize patching IBM Power LPARs that undergo Live Partition Mobility, since LPM significantly increases race probability
Restrict local shell and container access on affected hosts to trusted, authenticated users only

Patch Information

The fix moves the read of skb->len before the buffer is passed to VIOS, eliminating the post-send dereference. The change is present in the following upstream stable commits: Linux Kernel Commit 093b0e5, Linux Kernel Commit 25dddd0, Linux Kernel Commit 501ac6a, Linux Kernel Commit abaff27, and Linux Kernel Commit bdf5d13. Debian users should refer to the Debian LTS Announcement for backported package versions.

Workarounds

If patching cannot occur immediately, defer non-essential Live Partition Mobility operations on affected LPARs to reduce race triggering
Limit local user access and remove untrusted workloads from vulnerable IBM Power guests until updated kernels are deployed
Where feasible, migrate critical workloads to already-patched hosts before scheduling LPM activities

bash

# Verify installed kernel version against fixed stable commits
uname -r

# Debian/Ubuntu: apply distribution updates
sudo apt-get update && sudo apt-get upgrade linux-image-$(uname -r | sed 's/.*-//')

# Red Hat/SUSE on Power: apply vendor kernel updates
sudo dnf update kernel   # RHEL
sudo zypper update kernel-default   # SLES

# Reboot required to load the patched kernel
sudo systemctl reboot