CVE-2025-21659 (GCVE-0-2025-21659)
Vulnerability from cvelistv5
Published
2025-01-21 12:18
Modified
2026-08-05 11:53
Severity ?
8.1 (High) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must ensure that at the very least NAPI instance belongs to the same netns as the owner of the genl sock. napi_by_id() can become static now, but it needs to move because of dev_get_by_napi_id().
References
Impacted products
Vendor Product Version
Linux Linux Version: 27f91aaf49b3a50e5a02ad5fa27b7c453d029a72
Version: 27f91aaf49b3a50e5a02ad5fa27b7c453d029a72
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c",
            "net/core/dev.h",
            "net/core/netdev-genl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b683ba0df11ff563cc237eb1b74d6adfa77226bf",
              "status": "affected",
              "version": "27f91aaf49b3a50e5a02ad5fa27b7c453d029a72",
              "versionType": "git"
            },
            {
              "lessThan": "d1cacd74776895f6435941f86a1130e58f6dd226",
              "status": "affected",
              "version": "27f91aaf49b3a50e5a02ad5fa27b7c453d029a72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c",
            "net/core/dev.h",
            "net/core/netdev-genl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetdev: prevent accessing NAPI instances from another namespace\n\nThe NAPI IDs were not fully exposed to user space prior to the netlink\nAPI, so they were never namespaced. The netlink API must ensure that\nat the very least NAPI instance belongs to the same netns as the owner\nof the genl sock.\n\nnapi_by_id() can become static now, but it needs to move because of\ndev_get_by_napi_id()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through a generic-netlink socket (NETDEV family, NAPI_GET/NAPI_SET commands), which requires local execution on the target system. No remote or adjacent network path exists.\nAC:L - NAPI IDs are allocated sequentially from a small base (napi_gen_id starting at NR_CPUS, floor MIN_NAPI_ID), so an attacker can exhaustively enumerate every NAPI instance on the system in a trivial loop; there is no race, no memory-layout dependency, and the result is fully deterministic.\nPR:H - The read/info-leak path (NETDEV_CMD_NAPI_GET) needs no privileges at all, but the highest-impact path (NETDEV_CMD_NAPI_SET) is gated by GENL_ADMIN_PERM, which resolves to netlink_capable() against init_user_ns \u2014 i.e. real CAP_NET_ADMIN that cannot be obtained via unshare -Urn. This is routinely held by netns-confined containers and sandboxes (CNI plugins, VPN sidecars, ip netns exec, PrivateNetwork services) that are nonetheless meant to be isolated from the host\u0027s devices.\nUI:N - The attacker sends netlink messages entirely on their own; no victim action, mount, or file open is needed.\nS:C - The network namespace is the security authority that decides which net devices a process may observe and configure, and this bug lets a process confined to one netns read and reconfigure NAPI instances belonging to devices in the host or another tenant\u0027s netns. The impacted resources lie outside the vulnerable component\u0027s security scope, i.e. a sandbox/container boundary escape.\nC:L - netdev_nl_napi_fill_one() discloses a bounded but real set of cross-namespace data \u2014 the foreign device\u0027s ifindex, its hardware IRQ number, the NAPI kernel thread\u0027s PID in the init pid namespace, and all NAPI tunables \u2014 which leaks host topology and PID information into an isolated namespace. It is a limited, structured leak rather than an arbitrary memory read.\nI:H - netdev_nl_napi_set_config() lets the attacker write defer_hard_irqs, gro_flush_timeout and irq_suspend_timeout on every NAPI instance in the system, including the host\u0027s physical NICs \u2014 total control of that configuration surface across the namespace boundary, with direct and serious consequences for the impacted devices.\nA:H - Setting a large defer_hard_irqs together with a huge gro_flush_timeout makes napi_complete_done() return false so the driver never re-arms hardware interrupts, while napi-\u003etimer is armed far in the future \u2014 the targeted NIC\u0027s receive path stops being serviced, producing a complete network outage on the host or a co-tenant namespace from inside an isolated container."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:25.796Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b683ba0df11ff563cc237eb1b74d6adfa77226bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1cacd74776895f6435941f86a1130e58f6dd226"
        }
      ],
      "title": "netdev: prevent accessing NAPI instances from another namespace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21659",
    "datePublished": "2025-01-21T12:18:15.407Z",
    "dateReserved": "2024-12-29T08:45:45.732Z",
    "dateUpdated": "2026-08-05T11:53:25.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.