#VU106964 Integer overflow in Linux kernel - CVE-2025-21997
Vulnerability identifier: #VU106964
Vulnerability risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2025-21997
CWE-ID:
CWE-190
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to integer overflow within the xp_create_and_assign_umem() function in net/xdp/xsk_buff_pool.c. A local user can execute arbitrary code.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: 6.13, 6.13.1, 6.13.2, 6.13.3, 6.13.4, 6.13.5, 6.13.6, 6.13.7, 6.13.8
External links
https://git.kernel.org/stable/c/130290f44bce0eead2b827302109afc3fe189ddd
https://git.kernel.org/stable/c/205649d642a5b376724f04f3a5b3586815e43d3b
https://git.kernel.org/stable/c/559847f56769037e5b2e0474d3dbff985b98083d
https://git.kernel.org/stable/c/b7b4be1fa43294b50b22e812715198629806678a
https://git.kernel.org/stable/c/c7670c197b0f1a8726ad5c87bc2bf001a1fc1bbd
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.9
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
