medium 5.5

CVE-2025-21806 json

net: let net.core.dev_weight always be non-zero

published 2025-02-27 20 mo ago modified 2026-10-15 25 d ago also EUVD-2025-5987

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

The following problem was encountered during stability test:

(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ cut here ]------------ list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ next=ffff88905f746e40. WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ __list_add_valid_or_report+0xf3/0x130 CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ RIP: 0010:__list_add_valid_or_report+0xf3/0x130 Call Trace: ? __warn+0xcd/0x250 ? __list_add_valid_or_report+0xf3/0x130 enqueue_to_backlog+0x923/0x1070 netif_rx_internal+0x92/0x2b0 __netif_rx+0x15/0x170 loopback_xmit+0x2ef/0x450 dev_hard_start_xmit+0x103/0x490 __dev_queue_xmit+0xeac/0x1950 ip_finish_output2+0x6cc/0x1620 ip_output+0x161/0x270 ip_push_pending_frames+0x155/0x1a0 raw_sendmsg+0xe13/0x1550 __sys_sendto+0x3bf/0x4e0 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x5b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

The reproduction command is as follows: sysctl -w net.core.dev_weight=0 ping 127.0.0.1

This is because when the napi's weight is set to 0, process_backlog() may return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this napi to be re-polled in net_rx_action() until __do_softirq() times out. Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can be retriggered in enqueue_to_backlog(), causing this issue.

Making the napi's weight always non-zero solves this problem.

Triggering this issue requires system-wide admin (setting is not namespaced).

Patch / fix

fixed in 1 distros 6 links 8

Linux Linux 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.76, 6.12.13, 6.13.2, 6.14

debian ubuntu red hat suse almalinux rocky linux

linux Debian 12 6.1.129-1
linux Debian 14, Debian 13 6.12.13-1

debian advisories DEBIAN-CVE-2025-21806

linux Ubuntu 20.04 LTS 5.4.0-216.236
linux Ubuntu 22.04 LTS 5.15.0-140.150
linux Ubuntu 24.04 LTS 6.8.0-64.67
linux-aws Ubuntu 20.04 LTS 5.4.0-1146.156
linux-aws Ubuntu 22.04 LTS 5.15.0-1084.91
linux-aws Ubuntu 24.04 LTS 6.8.0-1032.34
linux-gcp Ubuntu 20.04 LTS 5.4.0-1149.158
linux-gcp Ubuntu 22.04 LTS 5.15.0-1083.92

ubuntu advisories UBUNTU-CVE-2025-21806

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-611.5.1.el9_7
rv RHEL 9 5.14.0-611.5.1.el9_7
perf RHEL 9 5.14.0-611.5.1.el9_7
rtla RHEL 9 5.14.0-611.5.1.el9_7
libperf RHEL 9 5.14.0-611.5.1.el9_7
kernel-rt RHEL 9 5.14.0-611.5.1.el9_7
kernel-64k RHEL 9 5.14.0-611.5.1.el9_7
kernel-core RHEL 9 5.14.0-611.5.1.el9_7

red hat advisories RHSA-2025:20518

kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.20.3.1
kernel-syms-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.20.3.1
kernel-source-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.20.3.1
kernel-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.39.1
kernel-syms-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.39.1
kernel-rt_debug Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.39.1
kernel-source-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.39.1
kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.3.1

suse advisories SUSE-SU-2025:01967-1 SUSE-SU-2025:01964-1 SUSE-SU-2025:01951-1 SUSE-SU-2025:01919-1 SUSE-SU-2025:01707-1 SUSE-SU-2025:01614-1

kernel AlmaLinux 9 5.14.0-611.5.1.el9_7
rv AlmaLinux 9 5.14.0-611.5.1.el9_7
perf AlmaLinux 9 5.14.0-611.5.1.el9_7
rtla AlmaLinux 9 5.14.0-611.5.1.el9_7
libperf AlmaLinux 9 5.14.0-611.5.1.el9_7
kernel-rt AlmaLinux 9 5.14.0-611.5.1.el9_7
kernel-64k AlmaLinux 9 5.14.0-611.5.1.el9_7
kernel-core AlmaLinux 9 5.14.0-611.5.1.el9_7

almalinux advisories ALSA-2025:20518

kernel Rocky Linux 9 5.14.0-611.5.1.el9_7

rocky linux advisories RLSA-2025:20518

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-21806 updated 2026-11-07 cvss 3.3

kernel: net: let net.core.dev_weight always be non-zero

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 10 kernel
affected: no fix available
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-611.5.1.el9_7, perf 5.14.0-611.5.1.el9_7, rtla 5.14.0-611.5.1.el9_7, python3-perf 5.14.0-611.5.1.el9_7, kernel-devel-matched 5.14.0-611.5.1.el9_7, kernel-64k-devel-matched 5.14.0-611.5.1.el9_7, +7 more Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-611.5.1.el9_7, kernel-64k 5.14.0-611.5.1.el9_7, kernel-core 5.14.0-611.5.1.el9_7, kernel-tools 5.14.0-611.5.1.el9_7, kernel-modules 5.14.0-611.5.1.el9_7, kernel-64k-core 5.14.0-611.5.1.el9_7, +27 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-s390x 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-x86_64 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-aarch64 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-ppc64le 5.14.0-611.5.1.el9_7 Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-611.5.1.el9_7, kernel-rt-64k 5.14.0-611.5.1.el9_7, kernel-rt-core 5.14.0-611.5.1.el9_7, kernel-rt-modules 5.14.0-611.5.1.el9_7, kernel-rt-64k-core 5.14.0-611.5.1.el9_7, kernel-rt-debug-core 5.14.0-611.5.1.el9_7, +14 more Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-611.5.1.el9_7, kernel-rt-core 5.14.0-611.5.1.el9_7, kernel-rt-modules 5.14.0-611.5.1.el9_7, kernel-rt-debug-core 5.14.0-611.5.1.el9_7, kernel-rt-modules-core 5.14.0-611.5.1.el9_7, kernel-rt-debug-modules 5.14.0-611.5.1.el9_7, +4 more
fixed: vendor fix RHSA-2025:20518

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-16 updated 2026-10-22 cvss 5.5

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-102-01 updated 2026-05-14 cvss 5.5

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-072-03 updated 2025-09-09 cvss 5.5

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - BIOS
affected: workaround, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux
Siemens SIMATIC S7-1500 TM MFP - BIOS
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Classification

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2025-21806
NVD CVE-2025-21806

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary

Patch / fix

Vendor advisories

Exploit prediction

CVSS scores

Affected products

Classification

References

Sources