CVE-2025-22060
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the mvpp2 driver has a vulnerability that can corrupt the parser TCAM memory. Concurrent access to TCAM and SRAM index registers without proper locking can cause writes to wrong rows and TOCTOU errors during row allocation. This was observed when mvpp2_set_rx_mode() ran on two CPUs simultaneously, corrupting the MVPP2_PE_MAC_UC_PROMISCUOUS entry and dropping all incoming unicast traffic.
Risk Assessment
The organization risks complete blocking of unicast traffic on network interfaces using the mvpp2 driver, potentially causing network service outages and packet loss.
Recommendation
Immediately update the Linux kernel to a version containing the fix that protects TCAM/SRAM operations from concurrent modifications. For production systems, apply the security patch or temporarily limit the number of CPUs handling network interrupts.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications. Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free rows in the hardware table, it must also be protected in order to avoid TOCTOU errors where multiple cores allocate the same row. This issue was detected in a situation where `mvpp2_set_rx_mode()` ran concurrently on two CPUs. In this particular case the MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the classifier unit to drop all incoming unicast - indicated by the `rx_classifier_drops` counter.