CVE-2025-21883
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-21883
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21883.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-21883
- Downstream
- Related
- Published
- 2025-03-27T14:57:11Z
- Modified
- 2025-10-22T10:06:26.958488Z
- Summary
- ice: Fix deinitializing VF in error path
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix deinitializing VF in error path
If iceenavfs() fails after calling icecreatevf_entries(), it frees all VFs without removing them from snapshot PF-VF mailbox list, leading to list corruption.
Reproducer: devlink dev eswitch set $PF1PCI mode switchdev ip l s $PF1 up ip l s $PF1 promisc on sleep 1 echo 1 > /sys/class/net/$PF1/device/sriovnumvfs sleep 1 echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
Trace (minimized): listadd corruption. next->prev should be prev (ffff8882e241c6f0), but was 0000000000000000. (next=ffff888455da1330). kernel BUG at lib/listdebug.c:29! RIP: 0010:_listaddvalidorreport+0xa6/0x100 icembxinitvfinfo+0xa7/0x180 [ice] iceinitializevfentry+0x1fa/0x250 [ice] icesriovconfigure+0x8d7/0x1520 [ice] ? _percpurefswitchmode+0x1b1/0x5d0 ? _pfxicesriovconfigure+0x10/0x10 [ice]
Sometimes a KASAN report can be seen instead with a similar stack trace: BUG: KASAN: use-after-free in _listaddvalidor_report+0xf1/0x100
VFs are added to this list in icembxinitvfinfo(), but only removed in icefreevfs(). Move the removing to icefreevfentries(), which is also being called in other places where VFs are being removed (including icefree_vfs() itself).
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/34393fd78d7183a007eaf0090966ebedcc29bd57
- https://git.kernel.org/stable/c/3c01102bec9592928e6b155da41cfcd5d25a2066
- https://git.kernel.org/stable/c/79990cf5e7aded76d0c092c9f5ed31eb1c75e02c
- https://git.kernel.org/stable/c/a4880583f88deba63504ce1c8287a70d39c01378
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8cd8a6b17d275a45e3722d0215f6115b687c8c3eFixed3c01102bec9592928e6b155da41cfcd5d25a2066
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8cd8a6b17d275a45e3722d0215f6115b687c8c3eFixeda4880583f88deba63504ce1c8287a70d39c01378
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8cd8a6b17d275a45e3722d0215f6115b687c8c3eFixed34393fd78d7183a007eaf0090966ebedcc29bd57
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8cd8a6b17d275a45e3722d0215f6115b687c8c3eFixed79990cf5e7aded76d0c092c9f5ed31eb1c75e02c