CVE-2025-21867 Overview
CVE-2025-21867 is a use-after-free vulnerability [CWE-416] in the Linux kernel's BPF test run subsystem. The flaw resides in eth_skb_pkt_type() and is triggered through bpf_prog_test_run_xdp() when an invalid user_data argument is supplied to bpf_test_init(). KMSAN detected the issue when the function accessed skb data that did not contain a valid Ethernet header. A local attacker with the ability to invoke BPF syscalls can exploit the condition to corrupt kernel memory, escalate privileges, or crash the system. The vulnerability affects multiple Linux kernel versions, including the 6.14 release candidates.
Critical Impact
Local, low-privileged attackers can trigger memory corruption in kernel space, leading to potential privilege escalation, information disclosure, or denial of service.
Affected Products
- Linux Kernel (multiple stable branches prior to fixed commits)
- Linux Kernel 6.14-rc1, 6.14-rc2, 6.14-rc3
- Downstream distributions including Debian LTS and Siemens industrial products (see Siemens Security Advisory SSA-019113)
Discovery Timeline
- 2025-03-27 - CVE-2025-21867 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2025-21867
Vulnerability Analysis
The vulnerability exists in the BPF test infrastructure used to exercise XDP (eXpress Data Path) programs from userspace. When a user invokes the BPF_PROG_TEST_RUN command with an XDP program, the kernel calls bpf_test_init() to allocate a test skb and populate it with user-supplied data. The function did not enforce a minimum size equal to ETH_HLEN (14 bytes) on the user_size parameter.
When the caller supplies a user_data value shorter than an Ethernet header, downstream code paths still treat the buffer as if it contained one. Subsequent calls into __xdp_build_skb_from_frame() and eth_type_trans() then invoke eth_skb_pkt_type(), which dereferences bytes past the valid allocation. Because the underlying page can be freed and reused between allocation and access, the read lands on freed memory.
Root Cause
The root cause is missing input validation in bpf_test_init() at net/bpf/test_run.c. The function accepted arbitrarily small user_size values without verifying that the buffer would contain at least an Ethernet header. The upstream fix returns an error when user_size < ETH_HLEN and also removes the redundant if (user_size > size) check. KMSAN traced the freed memory back to bpf_ringbuf_free() releasing pages via __free_pages(), confirming the use-after-free classification.
Attack Vector
Exploitation requires local access and the ability to issue BPF syscalls, which typically demands CAP_BPF or CAP_SYS_ADMIN. An attacker crafts a BPF_PROG_TEST_RUN request targeting an XDP program with a data_size_in smaller than 14 bytes. The kernel builds an skb from the undersized buffer, and the eth_type_trans() path reads freed memory. Depending on heap state, the attacker can influence packet type classification or trigger further memory corruption. See the upstream patch at Kernel Git Commit f615fcc for the exact fix.
Detection Methods for CVE-2025-21867
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing eth_skb_pkt_type, eth_type_trans, or __xdp_build_skb_from_frame in dmesg or /var/log/kern.log
- KASAN or KMSAN reports citing use-after-free reads in include/linux/etherdevice.h or net/ethernet/eth.c
- Unprivileged or containerized processes issuing bpf() syscalls with BPF_PROG_TEST_RUN and abnormally small data_size_in values
Detection Strategies
- Audit bpf() syscall usage with auditd rules targeting SYS_bpf (syscall 321 on x86_64) and flag BPF_PROG_TEST_RUN invocations from non-administrative accounts
- Deploy eBPF-based monitoring, such as bpftrace or tracee, to observe XDP test runs and correlate them with unexpected skb allocations
- Correlate kernel warning messages with process ancestry to identify suspicious workloads leveraging BPF test interfaces
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on stack traces containing bpf_prog_test_run_xdp alongside memory corruption keywords
- Track container and workload capability grants, specifically CAP_BPF and CAP_SYS_ADMIN, and alert on privilege changes
- Monitor for kernel module loads and unexpected privilege escalations following BPF activity
How to Mitigate CVE-2025-21867
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the vendor advisories for your kernel branch
- Update Debian systems per the Debian LTS Announcement 2025-05
- For Siemens industrial products, follow guidance in the Siemens Security Advisory SSA-019113
- Restrict CAP_BPF and CAP_SYS_ADMIN to trusted service accounts only
Patch Information
The fix is available in the following upstream commits: 1a9e128, 6b3d638, 972bafe, d56d8a2, and f615fcc. The patch validates that user_size >= ETH_HLEN in bpf_test_init() before proceeding with skb construction.
Workarounds
- Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from invoking BPF syscalls
- Remove CAP_BPF and CAP_SYS_ADMIN from container security contexts and Kubernetes pod specs where not required
- Use seccomp or SELinux/AppArmor profiles to block the bpf() syscall for workloads that do not need it
# Configuration example
# Disable unprivileged BPF access
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee -a /etc/sysctl.d/90-bpf-hardening.conf
# Verify current kernel version
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
