CVE-2025-21670

What it actually does

Missing null check on vsk->transport in vsock_bpf_recvmsg allows NULL pointer dereference during recvmsg on connected vsock sockets (stream/seqpacket) that have no transport assigned after a failed connect.

Why it matters to the business

Local denial-of-service via kernel panic on systems exposing vsock sockets to untrusted processes; low exploitation likelihood reduces immediate risk but still requires patching.

How an attack unfolds

An attacker creates a vsock socket, triggers a failed connect that leaves transport NULL, then calls recvmsg (or recvfrom) which enters the BPF path and dereferences the null transport pointer, crashing the kernel.

How to fix it

Upgrade the Linux kernel package on Debian 12 to version 6.1.99-1 or later; apply the fix that adds an early return when transport is not assigned.

How to confirm the fix worked

Confirm kernel version is 6.1.99-1 or newer; reproduce the vsock connect failure followed by recvmsg and verify no NULL dereference oops occurs.

Typical attack path

1. Create a vsock socket
2. Perform a connect that fails, leaving transport unassigned
3. Invoke recvmsg or recvfrom on the socket
4. Trigger the vsock_bpf_recvmsg path leading to vsock_connectible_has_data

How to detect it

Search kernel logs and dmesg for oops traces containing vsock_bpf_recvmsg, vsock_connectible_has_data, and NULL pointer dereference at address 00000000000000a0; correlate with processes calling recvfrom on vsock sockets.

• vsock_connectible_has_data+0x1f/0x40
• vsock_bpf_recvmsg+0xca/0x5e0
• BUG: kernel NULL pointer dereference, address: 00000000000000a0
• PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0
• Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI

What your security team should do

• Prioritize kernel package updates on all Debian 12 systems using vsock
• Monitor kernel logs for vsock-related NULL pointer oops entries
• Restrict unprivileged access to vsock sockets where feasible until patched