CVE-2025-22107 Overview
CVE-2025-22107 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's sja1105 Distributed Switch Architecture (DSA) driver. The flaw resides in the sja1105_table_delete_entry() function within the net/dsa/sja1105 subsystem. When deleting the last element of a table, the function incorrectly performs a memmove operation that touches memory past the end of the allocated buffer. The Kernel Address Sanitizer (KASAN) flagged the condition during kernel testing.
Critical Impact
A local, authenticated user with the ability to trigger sja1105 table deletions can cause kernel memory corruption or a system crash if the out-of-bounds element resides in an unmapped page.
Affected Products
- Linux Kernel (multiple stable branches prior to fix commits)
- Downstream distributions and appliances shipping the sja1105 DSA driver
- Siemens industrial products incorporating affected kernel versions (per Siemens advisory SSA-019113)
Discovery Timeline
- 2025-04-16 - CVE-2025-22107 published to the National Vulnerability Database (NVD)
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2025-22107
Vulnerability Analysis
The sja1105 driver supports NXP's SJA1105 automotive Ethernet switch through the Linux DSA framework. The sja1105_table_delete_entry() helper removes an entry from a fixed-size switch configuration table by shifting subsequent entries down with memmove. Two logic errors combine to read beyond the valid table range.
First, when the caller deletes the last valid entry (index i = size - 1), the function still executes the memmove, which references element i + 1. That element sits outside the allocated table. Second, the length passed to memmove computed size - i bytes instead of size - i - 1, causing the copy to read one element past the buffer boundary in all deletion paths.
Exploitation is constrained to local privileges and does not directly allow arbitrary code execution. The out-of-bounds memory is read and written back to itself, so no corrupted state persists in the driver. Impact depends on the memory layout adjacent to the table.
Root Cause
The root cause is an off-by-one boundary error in array element removal. The function did not special-case the deletion of the tail element, and the byte-count arithmetic for the shift operation included the out-of-bounds element. Both defects violate the buffer's boundary and are detectable by KASAN.
Attack Vector
A local user requires low-privileged access on a system running an affected kernel with the sja1105 DSA driver in use. Triggering table deletions through the driver's configuration interface produces the out-of-bounds read. If the byte immediately following the table resides in an unmapped page, the kernel oopses, resulting in a denial of service. On mapped adjacent memory the access is silent but detectable via KASAN in instrumented builds.
See the kernel commit log for the full patch details.
Detection Methods for CVE-2025-22107
Indicators of Compromise
- KASAN slab-out-of-bounds reports in kernel logs referencing sja1105_table_delete_entry
- Kernel oops or panic traces originating in net/dsa/sja1105/sja1105_dynamic_config.c
- Unexpected reboots of embedded switches or industrial gateways using the SJA1105 chipset
Detection Strategies
- Enable CONFIG_KASAN in test kernels to surface the boundary violation during driver stress testing
- Inventory running kernel versions with uname -r and correlate against the fixed commits 031e00249e9e, 4584486cfcca, 59b97641de03, 5f2b28b79d2d, b52153da1f42, f117d0467215, and f85b9bfb08ba
- Monitor dmesg and centralized log pipelines for kernel warnings mentioning sja1105 and out-of-bounds accesses
Monitoring Recommendations
- Ingest kernel logs from Linux hosts and embedded devices into a SIEM and alert on KASAN or oops signatures
- Track patch state of industrial control systems that expose the SJA1105 automotive switch to host management interfaces
- Review Siemens advisory SSA-019113 for product-specific update guidance
How to Mitigate CVE-2025-22107
Immediate Actions Required
- Apply the vendor-provided kernel update on any host or embedded device using the sja1105 DSA driver
- Restrict local shell and configuration access to trusted administrators only
- For Siemens products, follow the remediation steps published in advisory SSA-019113
Patch Information
The fix updates sja1105_table_delete_entry() to skip the memmove when deleting the last element and to shift exactly size - i - 1 elements otherwise. Backports are available for multiple stable branches through the following commits: 031e00249e9e, 4584486cfcca, 59b97641de03, 5f2b28b79d2d, b52153da1f42, f117d0467215, and f85b9bfb08ba.
Workarounds
- Unload or blacklist the sja1105 module on systems that do not require SJA1105 switch support
- Enforce least privilege for accounts that can invoke DSA switch configuration commands
- Isolate management interfaces of affected industrial devices on segmented networks until patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
