Go to homepageCyberStrike

Menu

Star on GitHub · 3.4k
Sign inDownload

CVE-2025-21806

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device)…

Published Feb 27, 2025EPSS 0.23%

Overview

CVE-2025-21806 is a medium-severity vulnerability. It was published on February 27, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: let net.core.dev_weight always be non-zero

The following problem was encountered during stability test:

(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \

returned 1, exceeding its budget of 0.

------------[ cut here ]------------

list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \

next=ffff88905f746e40.

WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \

__list_add_valid_or_report+0xf3/0x130

CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+

RIP: 0010:__list_add_valid_or_report+0xf3/0x130

Call Trace:

? __warn+0xcd/0x250

? __list_add_valid_or_report+0xf3/0x130

enqueue_to_backlog+0x923/0x1070

netif_rx_internal+0x92/0x2b0

__netif_rx+0x15/0x170

loopback_xmit+0x2ef/0x450

dev_hard_start_xmit+0x103/0x490

__dev_queue_xmit+0xeac/0x1950

ip_finish_output2+0x6cc/0x1620

ip_output+0x161/0x270

ip_push_pending_frames+0x155/0x1a0

raw_sendmsg+0xe13/0x1550

__sys_sendto+0x3

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/0e2f1d93d287d544d26f8ff293ea820a8079b9f8Refgit.kernel.org/stable/c/1489824e5226a26841c70639ebd2d1aed390764bRefgit.kernel.org/stable/c/33e2168788f8fb5cb8bd4f36cb1ef37d1d34dadaRefgit.kernel.org/stable/c/5860abbf15eeb61838b5e32e721ba67b0aa84450Refgit.kernel.org/stable/c/6ce38b5a6a49e65bad163162a54cb3f104c40b48Refgit.kernel.org/stable/c/c337c08819a4ec49edfdcd8fc46fbee120d8a5b2Refgit.kernel.org/stable/c/d0e0f9c8218826926d7692980c98236d9f21fd3cRefgit.kernel.org/stable/c/d1f9f79fa2af8e3b45cffdeef66e05833480148aReflists.debian.org/debian-lts-announce/2025/03/msg00028.htmlReflists.debian.org/debian-lts-announce/2025/05/msg00030.html

How CyberStrike helps

Frequently asked questions

What is CVE-2025-21806?

CVE-2025-21806 is a medium-severity vulnerability. It was published on February 27, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-21806?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2025-21806?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2025-21806?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2025-21806 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2025

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Watch the demo →