CVE-2025-22116 idpf: check error for register_netdev() on init
A missing error check in the idpf driver causes a kernel warning and potential crash when unregistering a failed network device.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-22116?
CVE-2025-22116 is a medium-severity vulnerability in Linux kernel, published on 16 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
idpf: check error for register_netdev() on init
Current init logic ignores the error code from register_netdev(), which will cause WARN_ON() on attempt to unregister it, if there was one, and there is no info for the user that the creation of the netdev failed.
WARNING: CPU: 89 PID: 6902 at net/core/dev.c:11512 unregister_netdevice_many_notify+0x211/0x1a10 ... [ 3707.563641] unregister_netdev+0x1c/0x30 [ 3707.563656] idpf_vport_dealloc+0x5cf/0xce0 [idpf] [ 3707.563684] idpf_deinit_task+0xef/0x160 [idpf] [ 3707.563712] idpf_vc_core_deinit+0x84/0x320 [idpf] [ 3707.563739] idpf_remove+0xbf/0x780 [idpf] [ 3707.563769] pci_device_remove+0xab/0x1e0 [ 3707.563786] device_release_driver_internal+0x371/0x530 [ 3707.563803] driver_detach+0xbf/0x180 [ 3707.563816] bus_remove_driver+0x11b/0x2a0 [ 3707.563829] pci_unregister_driver+0x2a/0x250
Introduce an error check and log the vport number and error code. On removal make sure to check VPORT_REG_NETDEV flag prior to calling unregister and free on the netdev.
Add local variables for idx, vport_config and netdev for readability.
Which versions are affected by CVE-2025-22116?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-22116?
Apply the vendor's patch.
Is CVE-2025-22116 being exploited?
There is no known exploitation of CVE-2025-22116 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-22116, DEBIAN-CVE-2025-22116, GHSA-whxm-hh66-2gfx, ROOT-OS-DEBIAN-13-CVE-2025-22116, ROOT-OS-UBUNTU-2404-CVE-2025-22116, UBUNTU-CVE-2025-22116.