CVE-2025-22117

What it actually does

The vulnerability permits an untrusted proto->raw.pkt_len value to be processed without bounds checking in ice_vc_fdir_parse_raw(), allowing values exceeding VIRTCHNL_MAX_SIZE_RAW_PACKET to reach internal packet handling logic and trigger availability impact.

Why it matters to the business

Systems running affected Red Hat realtime and NFV kernels may experience kernel instability or crashes under local workload conditions, leading to service interruptions in latency-sensitive or virtualized network environments; urgency is low given the absence of known exploitation and stable low EPSS.

How an attack unfolds

An attacker with local access crafts a malicious virtual channel flow director request containing an oversized pkt_len field; the missing validation in the ice driver accepts the value, which then propagates into raw packet parsing and can destabilize the kernel.

How to fix it

Upgrade all listed kernel-rt packages to version 0:4.18.0-553.32.1.rt7.373.el8_10 or later for both the nfv and realtime Red Hat Enterprise Linux 8 variants; apply the update through standard package management and reboot.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the fixed release string; confirm the ice driver source contains the explicit pkt_len bounds check against VIRTCHNL_MAX_SIZE_RAW_PACKET; retest virtual channel flow director operations under expected load.

Typical attack path

1. Obtain local user or process execution on a host running an affected kernel-rt package
2. Construct a virtchnl raw packet flow director command with pkt_len larger than VIRTCHNL_MAX_SIZE_RAW_PACKET
3. Submit the command through the ice driver virtual channel interface
4. Trigger the unvalidated path in ice_vc_fdir_parse_raw() resulting in kernel fault or denial of service

How to detect it

Review kernel logs for ice driver faults or oops messages referencing ice_vc_fdir_parse_raw or raw packet handling; correlate with virtchnl flow director activity from local processes; no public exploitation artifacts are known.

What your security team should do

• Prioritize patching of internet-facing or high-value realtime/NFV systems within standard maintenance windows
• Restrict local access and limit capabilities of untrusted processes on hosts using the ice driver
• Monitor Red Hat advisory channels for any follow-on kernel-rt updates
• Include the fixed package versions in automated compliance scanning