CVE-2025-21922 ppp: Fix KMSAN uninit-value warning with bpf
A local attacker can read uninitialized kernel memory via crafted BPF programs in the PPP driver, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21922?
CVE-2025-21922 is a medium-severity vulnerability in Linux kernel, published on 1 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ppp: Fix KMSAN uninit-value warning with bpf
Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the ppp driver not initializing a 2-byte header when using socket filter.
The following code can generate a PPP filter BPF program: ''' struct bpf_program fp; pcap_t *handle; handle = pcap_open_dead(DLT_PPP_PPPD, 65535); pcap_compile(handle, &fp, "ip and outbound", 0, 0); bpf_dump(&fp, 1); ''' Its output is: ''' (000) ldh [2] (001) jeq #0x21 jt 2 jf 5 (002) ldb [0] (003) jeq #0x1 jt 4 jf 5 (004) ret #65535 (005) ret #0 ''' Wen can find similar code at the following link: https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680 The maintainer of this code repository is also the original maintainer of the ppp driver.
As you can see the BPF program skips 2 bytes of data and then reads the 'Protocol' field to determine if it's an IP packet. Then it read the first byte of the first 2 bytes to determine the direction.
The issue is that only the first byte indicating direction is initialized in current ppp driver code while the second byte is not initialized.
For normal BPF programs generated by libpcap, uninitialized data won't be used, so it's not a problem. However, for carefully crafted BPF programs, such as those generated by syzkaller [2], which start reading from offset 0, the uninitialized data will be used and caught by KMSAN.
[1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791 [2] https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000
Weakness: CWE-908
Which versions are affected by CVE-2025-21922?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21922?
Apply the vendor's patch.
Is CVE-2025-21922 being exploited?
There is no known exploitation of CVE-2025-21922 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-59934, AZL-59973, BELL-CVE-2025-21922, DEBIAN-CVE-2025-21922, GHSA-6g9c-7jcv-4g45, ROOT-OS-UBUNTU-2404-CVE-2025-21922 and 1 more.