In the Linux kernel, the following vulnerability has been resolved:
llc: do not use skbget() before devqueue_xmit()
syzbot is able to crash hosts [1], using llc and devices not supporting IFFTXSKB_SHARING.
In this case, e1000 driver calls ethskbpad(), while the skb is shared.
Simply replace skbget() by skbclone() in net/llc/llcsac.c
Note that e1000 driver might have an issue with pktgen, because it does not clear IFFTXSKB_SHARING, this is an orthogonal change.
We need to audit other skb_get() uses in net/llc.
[1]
kernel BUG at net/core/skbuff.c:2178 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 16371 Comm: syz.2.2764 Not tainted 6.14.0-rc4-syzkaller-00052-gac9c34d1e45a #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:pskbexpandhead+0x6ce/0x1240 net/core/skbuff.c:2178 Call Trace: <TASK> _skbpad+0x18a/0x610 net/core/skbuff.c:2466 _skbputpadto include/linux/skbuff.h:3843 [inline] skbputpadto include/linux/skbuff.h:3862 [inline] ethskbpad include/linux/etherdevice.h:656 [inline] e1000xmitframe+0x2d99/0x5800 drivers/net/ethernet/intel/e1000/e1000main.c:3128 _netdevstartxmit include/linux/netdevice.h:5151 [inline] netdevstartxmit include/linux/netdevice.h:5160 [inline] xmitone net/core/dev.c:3806 [inline] devhardstartxmit+0x9a/0x7b0 net/core/dev.c:3822 schdirectxmit+0x1ae/0xc30 net/sched/schgeneric.c:343 _devxmitskb net/core/dev.c:4045 [inline] _devqueuexmit+0x13d4/0x43e0 net/core/dev.c:4621 devqueuexmit include/linux/netdevice.h:3313 [inline] llcsapactionsendtestc+0x268/0x320 net/llc/llcsac.c:144 llcexecsaptransactions net/llc/llcsap.c:153 [inline] llcsapnextstate net/llc/llcsap.c:182 [inline] llcsapstateprocess+0x239/0x510 net/llc/llcsap.c:209 llcuisendmsg+0xd0d/0x14e0 net/llc/afllc.c:993 socksendmsg_nosec net/socket.c:718 [inline]
[
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c",
"function": "llc_sap_action_send_xid_c"
},
"digest": {
"length": 407.0,
"function_hash": "38954579034858825060676690976343778629"
},
"id": "CVE-2025-21925-0cc00e41",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@416e8b4c20c6398044e93008deefd563289f477d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c",
"function": "llc_sap_action_send_test_c"
},
"digest": {
"length": 376.0,
"function_hash": "281373313947944302485140599526320621055"
},
"id": "CVE-2025-21925-34a3e718",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17f86e25431ebc15aa9245ff156414fdad47822d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c",
"function": "llc_sap_action_send_xid_c"
},
"digest": {
"length": 407.0,
"function_hash": "38954579034858825060676690976343778629"
},
"id": "CVE-2025-21925-3a57c543",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@056e8a46d79e22983bae4267e0d9c52927076f46",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c",
"function": "llc_sap_action_send_test_c"
},
"digest": {
"length": 376.0,
"function_hash": "281373313947944302485140599526320621055"
},
"id": "CVE-2025-21925-4857a907",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@056e8a46d79e22983bae4267e0d9c52927076f46",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"320938961083879878840833321580946828226",
"200847437207549829364560754447122009406",
"99575483555310832955380681522579526478",
"111257359864778799197067862649339609148",
"146353666994125511910612012676651305563",
"62803947759428765413826746082213442217",
"234330842061878547121795042661369900558",
"265703213318928356990990073143306100951",
"235967541365555632850524074540084428663",
"78944443332117178227665319422384837722",
"189158148434702871487436644296067289254",
"183410990291604769543749411551636519502",
"276564761257560020979114230388445492235",
"114712214457056963618582744750253111308",
"137994655581375528496116968967047683615",
"333781770979646247096331720836549983087",
"13397886714760626662056622983424560727",
"191512617082995672803297126699621933966",
"105191770616855345987172771745431797242",
"262911369847472591434254972454680558463",
"43907788540764797818987892243822647330",
"43634249493562388180470719758947006358",
"267114317258406438256045349216463877437",
"130328025854296961214796475932065454056",
"239331420564439604217783850080854628294",
"134178814148818463223259109128365051966",
"114712214457056963618582744750253111308",
"137994655581375528496116968967047683615",
"333781770979646247096331720836549983087",
"13397886714760626662056622983424560727",
"255237105838844901627688611584497541995",
"186874901014129798793914236529227808665",
"200317468002288738711481782458699766403",
"265703213318928356990990073143306100951",
"235967541365555632850524074540084428663",
"91741695220294879613875053058995275999",
"304942257043940324207178787661569849790",
"65777918773232292306156259944862129225",
"35004153267287381547363190436439058488",
"114712214457056963618582744750253111308",
"137994655581375528496116968967047683615",
"333781770979646247096331720836549983087",
"13397886714760626662056622983424560727",
"208639155032583243634940130570453432189",
"24289773204167354570311668802825158528"
]
},
"id": "CVE-2025-21925-74183814",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@056e8a46d79e22983bae4267e0d9c52927076f46",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c",
"function": "llc_sap_action_send_ui"
},
"digest": {
"length": 376.0,
"function_hash": "281373313947944302485140599526320621055"
},
"id": "CVE-2025-21925-9f029d2f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@056e8a46d79e22983bae4267e0d9c52927076f46",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"320938961083879878840833321580946828226",
"200847437207549829364560754447122009406",
"99575483555310832955380681522579526478",
"111257359864778799197067862649339609148",
"146353666994125511910612012676651305563",
"62803947759428765413826746082213442217",
"234330842061878547121795042661369900558",
"265703213318928356990990073143306100951",
"235967541365555632850524074540084428663",
"78944443332117178227665319422384837722",
"189158148434702871487436644296067289254",
"183410990291604769543749411551636519502",
"276564761257560020979114230388445492235",
"114712214457056963618582744750253111308",
"137994655581375528496116968967047683615",
"333781770979646247096331720836549983087",
"13397886714760626662056622983424560727",
"191512617082995672803297126699621933966",
"105191770616855345987172771745431797242",
"262911369847472591434254972454680558463",
"43907788540764797818987892243822647330",
"43634249493562388180470719758947006358",
"267114317258406438256045349216463877437",
"130328025854296961214796475932065454056",
"239331420564439604217783850080854628294",
"134178814148818463223259109128365051966",
"114712214457056963618582744750253111308",
"137994655581375528496116968967047683615",
"333781770979646247096331720836549983087",
"13397886714760626662056622983424560727",
"255237105838844901627688611584497541995",
"186874901014129798793914236529227808665",
"200317468002288738711481782458699766403",
"265703213318928356990990073143306100951",
"235967541365555632850524074540084428663",
"91741695220294879613875053058995275999",
"304942257043940324207178787661569849790",
"65777918773232292306156259944862129225",
"35004153267287381547363190436439058488",
"114712214457056963618582744750253111308",
"137994655581375528496116968967047683615",
"333781770979646247096331720836549983087",
"13397886714760626662056622983424560727",
"208639155032583243634940130570453432189",
"24289773204167354570311668802825158528"
]
},
"id": "CVE-2025-21925-a610a789",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17f86e25431ebc15aa9245ff156414fdad47822d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c",
"function": "llc_sap_action_send_xid_c"
},
"digest": {
"length": 407.0,
"function_hash": "38954579034858825060676690976343778629"
},
"id": "CVE-2025-21925-aedc7847",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17f86e25431ebc15aa9245ff156414fdad47822d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c",
"function": "llc_sap_action_send_ui"
},
"digest": {
"length": 376.0,
"function_hash": "281373313947944302485140599526320621055"
},
"id": "CVE-2025-21925-b0bfbd33",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17f86e25431ebc15aa9245ff156414fdad47822d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"320938961083879878840833321580946828226",
"200847437207549829364560754447122009406",
"99575483555310832955380681522579526478",
"111257359864778799197067862649339609148",
"146353666994125511910612012676651305563",
"62803947759428765413826746082213442217",
"234330842061878547121795042661369900558",
"265703213318928356990990073143306100951",
"235967541365555632850524074540084428663",
"78944443332117178227665319422384837722",
"189158148434702871487436644296067289254",
"183410990291604769543749411551636519502",
"276564761257560020979114230388445492235",
"114712214457056963618582744750253111308",
"137994655581375528496116968967047683615",
"333781770979646247096331720836549983087",
"13397886714760626662056622983424560727",
"191512617082995672803297126699621933966",
"105191770616855345987172771745431797242",
"262911369847472591434254972454680558463",
"43907788540764797818987892243822647330",
"43634249493562388180470719758947006358",
"267114317258406438256045349216463877437",
"130328025854296961214796475932065454056",
"239331420564439604217783850080854628294",
"134178814148818463223259109128365051966",
"114712214457056963618582744750253111308",
"137994655581375528496116968967047683615",
"333781770979646247096331720836549983087",
"13397886714760626662056622983424560727",
"255237105838844901627688611584497541995",
"186874901014129798793914236529227808665",
"200317468002288738711481782458699766403",
"265703213318928356990990073143306100951",
"235967541365555632850524074540084428663",
"91741695220294879613875053058995275999",
"304942257043940324207178787661569849790",
"65777918773232292306156259944862129225",
"35004153267287381547363190436439058488",
"114712214457056963618582744750253111308",
"137994655581375528496116968967047683615",
"333781770979646247096331720836549983087",
"13397886714760626662056622983424560727",
"208639155032583243634940130570453432189",
"24289773204167354570311668802825158528"
]
},
"id": "CVE-2025-21925-b95a4c05",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@416e8b4c20c6398044e93008deefd563289f477d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c",
"function": "llc_sap_action_send_ui"
},
"digest": {
"length": 376.0,
"function_hash": "281373313947944302485140599526320621055"
},
"id": "CVE-2025-21925-c027b9d1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@416e8b4c20c6398044e93008deefd563289f477d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/llc/llc_s_ac.c",
"function": "llc_sap_action_send_test_c"
},
"digest": {
"length": 376.0,
"function_hash": "281373313947944302485140599526320621055"
},
"id": "CVE-2025-21925-dfd166a2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@416e8b4c20c6398044e93008deefd563289f477d",
"signature_version": "v1"
}
]