Skip to content
OpenAdvisories
High · 7.5 CVE-2025-21868 EUVD-2025-8434GHSA-3w57-3p47-w8ch

net: allow small head cache usage with large MAX_SKB_FRAGS values

Published Mar 27, 2025 · Updated Aug 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: kernel Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-nvidia Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-xilinx Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

net: allow small head cache usage with large MAX_SKB_FRAGS values

Sabrina reported the following splat:

WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0
Modules linked in:
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014
RIP: 0010:netif_napi_add_weight_locked+0x8f2/0xba0
Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe <0f> 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48
RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e
RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6
RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c
R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168
R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007
FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
gro_cells_init+0x1ba/0x270
xfrm_input_init+0x4b/0x2a0
xfrm_init+0x38/0x50
ip_rt_init+0x2d7/0x350
ip_init+0xf/0x20
inet_init+0x406/0x590
do_one_initcall+0x9d/0x2e0
do_initcalls+0x23b/0x280
kernel_init_freeable+0x445/0x490
kernel_init+0x20/0x1d0
ret_from_fork+0x46/0x80
ret_from_fork_asm+0x1a/0x30
</TASK>
irq event stamp: 584330
hardirqs last enabled at (584338): [<ffffffff8168bf87>] __up_console_sem+0x77/0xb0
hardirqs last disabled at (584345): [<ffffffff8168bf6c>] __up_console_sem+0x5c/0xb0
softirqs last enabled at (583242): [<ffffffff833ee96d>] netlink_insert+0x14d/0x470
softirqs last disabled at (583754): [<ffffffff8317c8cd>] netif_napi_add_weight_locked+0x77d/0xba0

on kernel built with MAX_SKB_FRAGS=45, where SKB_WITH_OVERHEAD(1024)
is smaller than GRO_MAX_HEAD.

Such built additionally contains the revert of the single page frag cache
so that napi_get_frags() ends up using the page frag allocator, triggering
the splat.

Note that the underlying issue is independent from the mentioned
revert; address it ensuring that the small head cache will fit either TCP
and GRO allocation and updating napi_alloc_skb() and __netdev_alloc_skb()
to select kmalloc() usage for any allocation fitting such cache.

Affected products

VendorProductAffectedFixed
Linux Linux 6.4 6.6.117

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.12.17-1 —
Debian 13 linux 6.12.17-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux 6.8.0-78.78 USN-7703-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1035.37 USN-7703-1
Ubuntu 24.04 LTS linux-azure 6.8.0-1034.39 USN-7737-1
Ubuntu 24.04 LTS linux-azure-nvidia 6.8.0-1022.23 USN-7737-1
Ubuntu 24.04 LTS linux-gcp 6.8.0-1036.38 USN-7703-2
Ubuntu 24.04 LTS linux-gcp-6.11 +1 6.11.0-1015.15~24.04.1 USN-7521-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1032.36 USN-7703-4
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1019.21 USN-7703-2
Ubuntu 24.04 LTS linux-hwe-6.11 6.11.0-26.26~24.04.1 USN-7521-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1033.33 USN-7703-2
Ubuntu 24.04 LTS linux-intel +4 No fix yet —
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-78.78.1 USN-7703-1
Ubuntu 24.04 LTS linux-lowlatency-hwe-6.11 6.11.0-1014.15~24.04.1 USN-7521-3
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1035.38 USN-7703-4
Ubuntu 24.04 LTS linux-nvidia-6.11 6.11.0-1010.10 —
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1035.38.1 USN-7703-4
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1009.9 —
Ubuntu 24.04 LTS linux-oem-6.11 6.11.0-1022.22 USN-7521-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1032.33 USN-7703-3
Ubuntu 24.04 LTS linux-raspi 6.8.0-1035.39 USN-7703-4
Ubuntu 24.04 LTS linux-xilinx 6.8.0-1017.18 —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1035.37~22.04.1 USN-7703-2
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1034.39~22.04.1 USN-7737-1
Ubuntu 22.04 LTS linux-gcp-6.8 6.8.0-1036.38~22.04.1 USN-7703-2
Ubuntu 22.04 LTS linux-hwe-6.8 +1 6.8.0-78.78~22.04.1 USN-7703-4
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1033.33~22.04.1 USN-7703-2
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-78.78.1~22.04.1 USN-7703-1
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1035.38~22.04.1 USN-7703-4
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1032.33~22.04.1 USN-7703-3
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2028.29 USN-7719-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1030.31 USN-7703-1
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1030.31~22.04.1 —
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-78.78+fips1 —
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +6 6.4.0-150700.53.6.1 SUSE-SU-2025:02307-1
SLES 15 SP7 kernel-azure +2 6.4.0-150700.20.6.1 SUSE-SU-2025:02254-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.6.1.150700.17.6.1 SUSE-SU-2025:02307-1
SLES 15 SP6 kernel-64kb +3 6.4.0-150600.23.60.4 SUSE-SU-2025:02538-1
SLES 15 SP6 kernel-azure +2 6.4.0-150600.8.43.1 SUSE-SU-2025:02249-1
SLES 15 SP6 kernel-coco +3 6.4.0-15061.28.coco15sp6.1 SUSE-SU-2025:02923-1
SLES 15 SP6 kernel-default 6.4.0-150600.23.60.5 SUSE-SU-2025:02538-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.60.5.150600.12.26.4 SUSE-SU-2025:02538-1
SLES 15 SP6 kernel-docs +1 6.4.0-150600.23.60.3 SUSE-SU-2025:02538-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 kernel-rt +1 6.4.0-33.1 SUSE-SU-2025:20421-1
SLE Micro 6.0 kernel-rt +1 6.4.0-33.1 SUSE-SU-2025:20413-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.6.1 SUSE-SU-2025:02307-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_2 1-150700.1.5.1 SUSE-SU-2025:02333-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_2 1-150700.15.3.1 SUSE-SU-2025:02307-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.60.5 SUSE-SU-2025:02538-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_13 1-150600.1.5.1 SUSE-SU-2025:02335-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_13 1-150600.13.6.4 SUSE-SU-2025:02538-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.8.1 SUSE-SU-2025:02333-1
SUSE Real Time Module 15 SP6 kernel-rt +3 6.4.0-150600.10.44.1 SUSE-SU-2025:02335-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 dtb-aarch64 +2 6.4.0-150600.23.60.3 SUSE-SU-2025:02538-1
openSUSE Leap 15.6 kernel-64kb +5 6.4.0-150600.23.60.4 SUSE-SU-2025:02538-1
openSUSE Leap 15.6 kernel-azure +2 6.4.0-150600.8.43.1 SUSE-SU-2025:02249-1
openSUSE Leap 15.6 kernel-default 6.4.0-150600.23.60.5 SUSE-SU-2025:02538-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.60.5.150600.12.26.4 SUSE-SU-2025:02538-1
openSUSE Leap 15.6 kernel-obs-qa 6.4.0-150600.23.60.2 SUSE-SU-2025:02538-1
openSUSE Leap 15.6 kernel-rt +3 6.4.0-150600.10.44.1 SUSE-SU-2025:02335-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kernel 6.6.117.1-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-101.33.4.3.el10uek ELSA-2025-20530, ELSA-2025-20480

Advisories 20

References