CVE-2025-21883: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21883 Overview

CVE-2025-21883 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Intel Ethernet (ice) driver. The flaw occurs in the Virtual Function (VF) error-handling path when Single Root I/O Virtualization (SR-IOV) initialization fails. When ice_ena_vfs() fails after ice_create_vf_entries(), the driver frees VFs without removing them from the snapshot PF-VF mailbox list. This causes list corruption and can trigger a kernel BUG or a Kernel Address Sanitizer (KASAN) use-after-free report.

Critical Impact
A local user with privileges to configure SR-IOV can corrupt kernel memory structures, leading to system crashes and potential local privilege escalation on hosts using Intel ice-driven NICs.

Affected Products

Linux Kernel (stable branches receiving the ice driver backports)
Linux Kernel 6.14-rc1 through 6.14-rc4
Systems using Intel Ethernet 800 Series adapters with SR-IOV enabled

Discovery Timeline

2025-03-27 - CVE-2025-21883 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21883

Vulnerability Analysis

The vulnerability resides in the ice driver's SR-IOV enablement path. During ice_ena_vfs(), the driver calls ice_create_vf_entries(), which invokes ice_mbx_init_vf_info() to add each VF to the PF-VF mailbox snapshot list. If a subsequent step in ice_ena_vfs() fails, the cleanup path frees the VF structures directly without unlinking them from that mailbox list.

When SR-IOV is re-enabled after this failure, ice_mbx_init_vf_info() attempts to insert freed list nodes into the mailbox list. The linked list contains dangling pointers referencing freed memory, so __list_add_valid_or_report() detects corrupted next/prev pointers and calls BUG() at lib/list_debug.c:29. With KASAN enabled, the same condition surfaces as a use-after-free report.

The upstream patch relocates the list removal from ice_free_vfs() into ice_free_vf_entries(), ensuring VFs are unlinked from the mailbox list in every cleanup path, including error unwind.

Root Cause

The root cause is an asymmetric resource lifecycle. VFs are added to the mailbox snapshot list in ice_mbx_init_vf_info(), but list removal is performed only in the top-level ice_free_vfs() function. Error paths that bypass ice_free_vfs() and free VF entries directly leave stale entries in the list, producing use-after-free and list corruption.

Attack Vector

Exploitation requires local access with capability to configure SR-IOV, typically CAP_SYS_ADMIN. The reproducer switches the physical function to switchdev eswitch mode and toggles sriov_numvfs to trigger the failing initialization. Once the list is corrupted, subsequent operations on the mailbox list dereference freed memory, giving an attacker with SR-IOV privileges a path to memory corruption on the host kernel.

Because realCodeExamples were not provided, refer to the upstream commits 79990cf5e7ad, 34393fd78d71, 3c01102bec95, and a4880583f88d for the exact patched source. See the Linux Kernel Commit 79990cf5e for the primary fix.

Detection Methods for CVE-2025-21883

Indicators of Compromise

Kernel log entries containing list_add corruption. next->prev should be prev originating from ice_mbx_init_vf_info or ice_initialize_vf_entry.
KASAN reports of use-after-free in __list_add_valid_or_report with ice driver frames in the stack trace.
Unexpected kernel panics or BUG at lib/list_debug.c:29 on hosts with Intel ice NICs after SR-IOV toggling.

Detection Strategies

Enumerate running kernel versions across the fleet and flag hosts on 6.14-rc1 through 6.14-rc4 or unpatched stable branches that ship the ice driver.
Monitor kernel ring buffer (dmesg, journalctl -k) for ice driver errors during or after sriov_numvfs write events.
Audit which non-root accounts or containers hold CAP_SYS_ADMIN or write access to /sys/class/net/*/device/sriov_numvfs.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on list_add corruption, KASAN, and ice module oops signatures.
Track writes to sriov_numvfs and devlink dev eswitch set invocations through auditd rules on hypervisor hosts.
Baseline VF creation and destruction events so repeated rapid toggles by the same user become anomalies for review.

How to Mitigate CVE-2025-21883

Immediate Actions Required

Apply the stable kernel update containing commits 79990cf5e7ad, 34393fd78d71, 3c01102bec95, or a4880583f88d, whichever matches the deployed branch.
Restrict CAP_SYS_ADMIN and write access to /sys/class/net/*/device/sriov_numvfs on hosts where SR-IOV is exposed.
On unpatched hypervisors, avoid dynamic SR-IOV reconfiguration and configure VF counts once at boot.

Patch Information

The fix moves the mailbox list removal from ice_free_vfs() into ice_free_vf_entries() so every VF cleanup path unlinks entries correctly. Upstream fixes are available in the following commits: 34393fd78d71, 3c01102bec95, 79990cf5e7ad, and a4880583f88d. Consume the fix from your distribution's patched kernel package rather than cherry-picking manually where possible.

Workarounds

Disable SR-IOV on affected hosts by setting sriov_numvfs to 0 and preventing runtime changes until patched.
Do not switch the ice physical function into switchdev eswitch mode on unpatched kernels.
Constrain container and VM management tooling so only trusted operators can trigger VF creation.

bash

# Disable SR-IOV on an ice-managed interface until the patched kernel is deployed
echo 0 | sudo tee /sys/class/net/<PF_INTERFACE>/device/sriov_numvfs

# Verify the running kernel includes the fix commit
dmesg | grep -i 'ice' | grep -Ei 'list_add|KASAN|use-after-free'