CVE-2025-22107

What it actually does

Out-of-bounds memory access during deletion of the last table entry in sja1105_table_delete_entry due to incorrect memmove length calculation and off-by-one handling that touches an element beyond the array bounds.

Why it matters to the business

Potential kernel memory corruption on affected Linux systems using sja1105 DSA switches, which can lead to crashes, data exposure, or local privilege escalation; high urgency given related kernel privilege-escalation activity by multiple threat actors and widespread kernel deployment.

How an attack unfolds

An attacker with local access crafts input that triggers repeated table entry deletions in the sja1105 driver, causing the kernel to perform an out-of-bounds read via memmove on the final element; this can be chained with other kernel primitives for privilege escalation as seen in similar CVEs exploited by threat actors.

How to fix it

Update the Linux kernel to a version containing the fix for CVE-2025-22107; for Red Hat Enterprise Linux 9.2 EUS systems apply the postgresql packages fixed in version 0:15.10-1.module+el9.2.0+22561+45645a4b.1 or later equivalent kernel updates that resolve the sja1105 driver issue.

How to confirm the fix worked

Confirm the installed kernel or postgresql package versions match or exceed the listed fixed versions; run KASAN-enabled kernels and exercise sja1105 table deletion paths to verify absence of out-of-bounds warnings.

Typical attack path

1. Obtain local user access on a system with the sja1105 DSA driver loaded
2. Trigger deletion of the final element in an sja1105 table structure
3. Force the driver to execute the flawed memmove that accesses memory beyond array bounds
4. Leverage resulting memory corruption to escalate privileges or cause denial of service

How to detect it

Inspect kernel logs for KASAN out-of-bounds warnings referencing sja1105_table_delete_entry; correlate with process activity involving DSA or sja1105 modules and review audit logs for unusual local privilege-escalation attempts similar to those used by actors exploiting related kernel CVEs.

• sja1105_table_delete_entry
• KASAN: out-of-bounds in net/dsa/sja1105
• memmove.*element i+1 is out of bounds

What your security team should do

• Prioritize patching all affected systems before the CISA remediation deadline if added to KEV
• Monitor for local privilege-escalation attempts involving kernel table operations
• Restrict local access and apply least-privilege principles until patches are deployed
• Review downstream dependents and kernel modules using sja1105 for similar patterns