CVE-2025-21670 vsock/bpf: return early if transport is not assigned
A local attacker can trigger a kernel crash by calling recvfrom on a vsock socket with an unassigned transport, causing a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21670?
CVE-2025-21670 is a medium-severity vulnerability in Linux kernel, published on 31 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vsock/bpf: return early if transport is not assigned
Some of the core functions can only be called if the transport has been assigned.
As Michal reported, a socket might have the transport at NULL, for example after a failed connect(), causing the following trace:
BUG: kernel NULL pointer dereference, address: 00000000000000a0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+ RIP: 0010:vsock_connectible_has_data+0x1f/0x40 Call Trace: vsock_bpf_recvmsg+0xca/0x5e0 sock_recvmsg+0xb9/0xc0 __sys_recvfrom+0xb3/0x130 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e
So we need to check the `vsk->transport` in vsock_bpf_recvmsg(), especially for connected sockets (stream/seqpacket) as we already do in __vsock_connectible_recvmsg().
Weakness: CWE-476
Which versions are affected by CVE-2025-21670?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21670?
Apply the vendor's patch.
Is CVE-2025-21670 being exploited?
There is no known exploitation of CVE-2025-21670 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-56396, BELL-CVE-2025-21670, DEBIAN-CVE-2025-21670, GHSA-9w9r-vq29-w437, UBUNTU-CVE-2025-21670.