In the Linux kernel, the following vulnerability has been resolved:
net: let net.core.dev_weight always be non-zero
The following problem was encountered during stability test:
(NULL netdevice): NAPI poll function processbacklog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ cut here ]------------ listadd double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ next=ffff88905f746e40. WARNING: CPU: 18 PID: 5462 at lib/listdebug.c:35 \ listaddvalidorreport+0xf3/0x130 CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ RIP: 0010:listaddvalidorreport+0xf3/0x130 Call Trace: ? _warn+0xcd/0x250 ? _listaddvalidorreport+0xf3/0x130 enqueuetobacklog+0x923/0x1070 netifrxinternal+0x92/0x2b0 _netifrx+0x15/0x170 loopbackxmit+0x2ef/0x450 devhardstartxmit+0x103/0x490 _devqueuexmit+0xeac/0x1950 ipfinishoutput2+0x6cc/0x1620 ipoutput+0x161/0x270 ippushpendingframes+0x155/0x1a0 rawsendmsg+0xe13/0x1550 _syssendto+0x3bf/0x4e0 _x64syssendto+0xdc/0x1b0 dosyscall64+0x5b/0x170 entrySYSCALL64after_hwframe+0x76/0x7e
The reproduction command is as follows: sysctl -w net.core.dev_weight=0 ping 127.0.0.1
This is because when the napi's weight is set to 0, processbacklog() may return 0 and clear the NAPISTATESCHED bit of napi->state, causing this napi to be re-polled in netrxaction() until _dosoftirq() times out. Since the NAPISTATESCHED bit has been cleared, napischedulerps() can be retriggered in enqueueto_backlog(), causing this issue.
Making the napi's weight always non-zero solves this problem.
Triggering this issue requires system-wide admin (setting is not namespaced).
[
{
"target": {
"file": "net/core/sysctl_net_core.c"
},
"digest": {
"line_hashes": [
"38501742927051557401344193867837603536",
"288091140323237333349654770385392819907",
"203868401200615399782301814026066007262",
"5974711702213709103264786593259359959",
"143772910015230483824362116816482216202",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"44623971056718554181719457464502730703",
"130918063732550196472301480907049612298",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"262504385664110636815428165461254917868",
"93713661009930528416940073959409955077",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"211095201055164396389823215928504570931"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5860abbf15eeb61838b5e32e721ba67b0aa84450",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-21806-2486c4fd"
},
{
"target": {
"file": "net/core/sysctl_net_core.c"
},
"digest": {
"line_hashes": [
"38501742927051557401344193867837603536",
"288091140323237333349654770385392819907",
"203868401200615399782301814026066007262",
"5974711702213709103264786593259359959",
"143772910015230483824362116816482216202",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"44623971056718554181719457464502730703",
"130918063732550196472301480907049612298",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"262504385664110636815428165461254917868",
"93713661009930528416940073959409955077",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"211095201055164396389823215928504570931"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c337c08819a4ec49edfdcd8fc46fbee120d8a5b2",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-21806-79e8006d"
},
{
"target": {
"file": "net/core/sysctl_net_core.c"
},
"digest": {
"line_hashes": [
"38501742927051557401344193867837603536",
"288091140323237333349654770385392819907",
"203868401200615399782301814026066007262",
"332022223872715739524040205562240531400",
"143772910015230483824362116816482216202",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"44623971056718554181719457464502730703",
"130918063732550196472301480907049612298",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"262504385664110636815428165461254917868",
"93713661009930528416940073959409955077",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"211095201055164396389823215928504570931"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33e2168788f8fb5cb8bd4f36cb1ef37d1d34dada",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-21806-871e6d58"
},
{
"target": {
"file": "net/core/sysctl_net_core.c"
},
"digest": {
"line_hashes": [
"38501742927051557401344193867837603536",
"288091140323237333349654770385392819907",
"203868401200615399782301814026066007262",
"5974711702213709103264786593259359959",
"143772910015230483824362116816482216202",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"44623971056718554181719457464502730703",
"130918063732550196472301480907049612298",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"262504385664110636815428165461254917868",
"93713661009930528416940073959409955077",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"211095201055164396389823215928504570931"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e2f1d93d287d544d26f8ff293ea820a8079b9f8",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-21806-901bbc18"
},
{
"target": {
"file": "net/core/sysctl_net_core.c"
},
"digest": {
"line_hashes": [
"38501742927051557401344193867837603536",
"288091140323237333349654770385392819907",
"203868401200615399782301814026066007262",
"5974711702213709103264786593259359959",
"143772910015230483824362116816482216202",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"44623971056718554181719457464502730703",
"130918063732550196472301480907049612298",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"262504385664110636815428165461254917868",
"93713661009930528416940073959409955077",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"211095201055164396389823215928504570931"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0e0f9c8218826926d7692980c98236d9f21fd3c",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-21806-b7c32e35"
},
{
"target": {
"file": "net/core/sysctl_net_core.c"
},
"digest": {
"line_hashes": [
"38501742927051557401344193867837603536",
"288091140323237333349654770385392819907",
"203868401200615399782301814026066007262",
"332022223872715739524040205562240531400",
"143772910015230483824362116816482216202",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"44623971056718554181719457464502730703",
"130918063732550196472301480907049612298",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"262504385664110636815428165461254917868",
"93713661009930528416940073959409955077",
"57900622214064583507171544525954400410",
"299679511986992075855508574089664453301",
"211095201055164396389823215928504570931"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1489824e5226a26841c70639ebd2d1aed390764b",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-21806-c47d8901"
}
]