CVE-2025-21681

What it actually does

The flaw triggers an infinite loop inside skb_tx_hash when OVS calls dev_queue_xmit on a net device that is unregistering (real_num_tx_queues drops to zero) yet still reports carrier OK and has not cleared the running flag.

Why it matters to the business

Systems using Open vSwitch, especially those relying on dummy interfaces for debugging or packet capture, can experience a hard CPU lockup that forces an immediate reboot, interrupting network services and any workloads dependent on the OVS datapath.

How an attack unfolds

An attacker with the ability to inject traffic into an OVS bridge sends packets destined for a net device (commonly a dummy interface) that is in the process of unregistering; the kernel path through ovs_vport_send and skb_tx_hash enters an endless while loop, locking the core without any further attacker interaction.

How to fix it

Upgrade the Linux kernel to version 6.1.127 or later, or apply commit b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092; ensure both carrier and running flags are checked before transmitting packets from the OVS datapath.

How to confirm the fix worked

Confirm the running kernel contains the fix by inspecting the skb_tx_hash call site or the OVS vport transmit path for the additional running-state check; test by unregistering a dummy interface while generating traffic through OVS and verifying no lockup occurs.

Typical attack path

1. Gain ability to forward packets through an OVS bridge
2. Target a net device (e.g., dummy) that is unregistering while carrier remains up
3. Trigger do_output → ovs_vport_send → dev_queue_xmit path
4. Enter infinite loop in skb_tx_hash due to zero tx queues

How to detect it

Inspect kernel logs for OVS transmit paths or netdevice unregister events coinciding with sudden system unresponsiveness; correlate with use of dummy or similar interfaces in OVS bridges.

What your security team should do

• Apply the kernel update containing commit b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092 as soon as possible on all systems running OVS
• Replace or avoid use of dummy interfaces as packet sinks in production OVS deployments until patched
• Monitor kernel logs and system availability for unexplained CPU lockups on OVS hosts