CVE-2025-21669

vsock/virtio: discard packets if the transport changes

State: Published
Severity: 7.8 High
Published: Jan 31, 2025
Updated: Oct 15, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: discard packets if the transport changes

If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected and would cause issues when we access vsk->transport.

A possible scenario is described by Hyunwoo Kim in the attached link, where after a first connect() interrupted by a signal, and a second connect() failed, we can find `vsk->transport` at NULL, leading to a NULL pointer dereference.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 18a7fc371d1dbf8deff16c2dd9292bcc73f43040Affected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 6486915fa661584d70e8e7e4068c6c075c67dd6dAffected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 88244163bc7e7b0ce9dd7bf4c8a563b41525c3eeAffected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before d88b249e14bd0ee1e46bbe4f456e22e01b8c68deAffected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 677579b641af109613564460a4e3bdcb16850b61Affected c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 2cb7c756f605ec02ffe562fb26828e4bcc5fdfc1Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.10.234 through 5.10.Not affected 5.15.177 through 5.15.Not affected 6.1.127 through 6.1.Not affected 6.6.74 through 6.6.Not affected 6.12.11 through 6.12.*Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 18a7fc371d1dbf8deff16c2dd9292bcc73f43040Affected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 6486915fa661584d70e8e7e4068c6c075c67dd6dAffected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 88244163bc7e7b0ce9dd7bf4c8a563b41525c3eeAffected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before d88b249e14bd0ee1e46bbe4f456e22e01b8c68deAffected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 677579b641af109613564460a4e3bdcb16850b61Affected
c0cfa2d8a788fcf45df5bf4070ab2474c88d543a to before 2cb7c756f605ec02ffe562fb26828e4bcc5fdfc1Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.10.234 through 5.10.*Not affected
5.15.177 through 5.15.*Not affected
6.1.127 through 6.1.*Not affected
6.6.74 through 6.6.*Not affected
6.12.11 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.