CVE-2025-21680

What it actually does

The vulnerability allows an out-of-bounds array access in the pktgen module's get_imix_entries function due to an incorrect boundary check on the imix_entries array, potentially leading to kernel memory corruption or crashes.

Why it matters to the business

Systems running vulnerable Linux kernels may experience crashes or allow local attackers to escalate privileges, impacting system availability and security, especially in environments using pktgen for network testing; widespread kernel prevalence increases exposure across servers and devices.

How an attack unfolds

An attacker with local access crafts input with more than 20 imix entries when writing to the pktgen proc interface, triggering the out-of-bounds access in the kernel module as shown in the call trace involving pktgen_if_write.

How to fix it

Update the Linux kernel to a version containing commit 3450092cc2d1c311c5ea92a2486daa2a33520ea5 or later stable releases that correct the boundary check in net/core/pktgen.c.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit hash, reproduce pktgen writes with maximum imix entries without triggering UBSAN reports, and verify no out-of-bounds warnings in dmesg.

Typical attack path

1. Obtain local shell access on a vulnerable Linux system
2. Write excessive imix entries via the pktgen proc interface
3. Trigger array-index-out-of-bounds in get_imix_entries leading to kernel fault or corruption

How to detect it

Inspect kernel logs and dmesg for UBSAN array-index-out-of-bounds messages referencing net/core/pktgen.c:874 or call traces involving get_imix_entries and pktgen_if_write.

• UBSAN: array-index-out-of-bounds in net/core/pktgen.c:874:24
• index 20 is out of range for type 'imix_pkt [20]'
• get_imix_entries net/core/pktgen.c:874

What your security team should do

• Apply the kernel update containing commit 3450092cc2d1c311c5ea92a2486daa2a33520ea5 as soon as possible
• Restrict unprivileged write access to pktgen proc interfaces where feasible
• Monitor kernel logs for pktgen-related UBSAN or out-of-bounds events