CVE-2025-22106 vmxnet3: unregister xdp rxq info in the reset path
A missing unregister call in the vmxnet3 driver reset path causes a kernel warning and potential crash, requiring a patch to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-22106?
CVE-2025-22106 is a medium-severity vulnerability in Linux kernel, published on 16 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vmxnet3: unregister xdp rxq info in the reset path
vmxnet3 does not unregister xdp rxq info in the vmxnet3_reset_work() code path as vmxnet3_rq_destroy() is not invoked in this code path. So, we get below message with a backtrace.
Missing unregister, handled but fix driver WARNING: CPU:48 PID: 500 at net/core/xdp.c:182 __xdp_rxq_info_reg+0x93/0xf0
This patch fixes the problem by moving the unregister code of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup().
Which versions are affected by CVE-2025-22106?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-22106?
Apply the vendor's patch.
Is CVE-2025-22106 being exploited?
There is no known exploitation of CVE-2025-22106 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-62583, BELL-CVE-2025-22106, DEBIAN-CVE-2025-22106, GHSA-646x-rjhr-jf76, ROOT-OS-DEBIAN-13-CVE-2025-22106, ROOT-OS-UBUNTU-2404-CVE-2025-22106 and 1 more.