CVE-2025-21676
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In the Linux kernel's FEC (Fast Ethernet Controller) driver, a vulnerability was found where the error return from page_pool_dev_alloc_pages is not handled. When memory allocation fails, the driver uses a NULL pointer, causing a system crash. This occurs under memory pressure, e.g., during SMB writes to a SATA HDD on i.MX6Q.
Risk Assessment
The risk is a potential denial-of-service (DoS) attack by exhausting memory, leading to network service disruption and downtime. An attacker can crash the system without administrative privileges by triggering memory pressure.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit that handles the allocation error). As a temporary workaround, increase /proc/sys/vm/min_free_kbytes to reduce the chance of memory exhaustion.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd function calls page_pool_dev_alloc_pages but did not handle the case when it returned NULL. There was a WARN_ON(!new_page) but it would still proceed to use the NULL pointer and then crash. This case does seem somewhat rare but when the system is under memory pressure it can happen. One case where I can duplicate this with some frequency is when writing over a smbd share to a SATA HDD attached to an imx6q. Setting /proc/sys/vm/min_free_kbytes to higher values also seems to solve the problem for my test case. But it still seems wrong that the fec driver ignores the memory allocation error and can crash. This commit handles the allocation error by dropping the current packet.