CVE-2025-21921
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device ethnl_req_get_phydev() is used to lookup a phy_device, in the case an ethtool netlink command targets a specific phydev within a netdev's topology. It takes as a parameter a const struct nlattr *header that's used for error handling : if (!phydev) { NL_SET_ERR_MSG_ATTR(extack, header, "no phy matching phyindex"); return ERR_PTR(-ENODEV); } In the notify path after a ->set operation however, there's no request attributes available. The typical callsite for the above function looks like: phydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER], info->extack); So, when tb is NULL (such as in the ethnl notify path), we have a nice crash. It turns out that there's only the PLCA command that is in that case, as the other phydev-specific commands don't have a notification. This commit fixes the crash by passing the cmd index and the nlattr array separately, allowing NULL-checking it directly inside the helper.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-04-01 16:15:22.790000
Last modified
2026-11-05 21:17:46.523000
View original CVE JSON
{
"id": "CVE-2025-21921",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-04-01T16:15:22.790",
"lastModified": "2026-11-05T21:17:46.523",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethtool: netlink: Allow NULL nlattrs when getting a phy_device\n\nethnl_req_get_phydev() is used to lookup a phy_device, in the case an\nethtool netlink command targets a specific phydev within a netdev's\ntopology.\n\nIt takes as a parameter a const struct nlattr *header that's used for\nerror handling :\n\n if (!phydev) {\n NL_SET_ERR_MSG_ATTR(extack, header,\n \"no phy matching phyindex\");\n return ERR_PTR(-ENODEV);\n }\n\nIn the notify path after a ->set operation however, there's no request\nattributes available.\n\nThe typical callsite for the above function looks like:\n\n\tphydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER],\n\t\t\t\t info->extack);\n\nSo, when tb is NULL (such as in the ethnl notify path), we have a nice\ncrash.\n\nIt turns out that there's only the PLCA command that is in that case, as\nthe other phydev-specific commands don't have a notification.\n\nThis commit fixes the crash by passing the cmd index and the nlattr\narray separately, allowing NULL-checking it directly inside the helper."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ethtool: netlink: Permite nlattrs nulos al obtener un phy_device. ethnl_req_get_phydev() se usa para buscar un phy_device si el comando netlink de ethtool apunta a un phydev específico dentro de la topología de un netdev. Toma como parámetro una constante struct nlattr *header que se usa para la gestión de errores: if (!phydev) { NL_SET_ERR_MSG_ATTR(extack, header, \"no phy matches phyindex\"); return ERR_PTR(-ENODEV); } Sin embargo, en la ruta de notificación después de una operación ->set, no hay atributos de solicitud disponibles. El sitio de llamada típico para la función anterior se ve así: phydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER], info->extack); Por lo tanto, cuando tb es nulo (como en la ruta de notificación de ethnl), se produce un fallo. Resulta que solo el comando PLCA se encuentra en ese caso, ya que los demás comandos específicos de phydev no tienen notificación. Esta confirmación corrige el fallo pasando el índice cmd y la matriz nlattr por separado, lo que permite comprobar su estado nulo directamente dentro del asistente."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/ethtool/cabletest.c",
"net/ethtool/linkstate.c",
"net/ethtool/netlink.c",
"net/ethtool/netlink.h",
"net/ethtool/phy.c",
"net/ethtool/plca.c",
"net/ethtool/pse-pd.c",
"net/ethtool/stats.c",
"net/ethtool/strset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "c15e065b46dc4e19837275b826c1960d55564abd",
"lessThan": "639c70352958735addbba5ae7dd65985da96e061",
"versionType": "git",
"status": "affected"
},
{
"version": "c15e065b46dc4e19837275b826c1960d55564abd",
"lessThan": "1f458fa42c29144cef280e05bc49fc21b873d897",
"versionType": "git",
"status": "affected"
},
{
"version": "c15e065b46dc4e19837275b826c1960d55564abd",
"lessThan": "637399bf7e77797811adf340090b561a8f9d1213",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/ethtool/cabletest.c",
"net/ethtool/linkstate.c",
"net/ethtool/netlink.c",
"net/ethtool/netlink.h",
"net/ethtool/phy.c",
"net/ethtool/plca.c",
"net/ethtool/pse-pd.c",
"net/ethtool/stats.c",
"net/ethtool/strset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.12",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.12",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.19",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.13.7",
"lessThanOrEqual": "6.13.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.14",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-05T20:37:00.578572Z",
"id": "CVE-2025-21921",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12",
"versionEndExcluding": "6.12.19",
"matchCriteriaId": "EC0CC37A-843F-489C-B8A2-45012E0AF641"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.13.7",
"matchCriteriaId": "842F5A44-3E71-4546-B4FD-43B0ACE3F32B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
"matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*",
"matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*",
"matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*",
"matchCriteriaId": "45B90F6B-BEC7-4D4E-883A-9DBADE021750"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/1f458fa42c29144cef280e05bc49fc21b873d897",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/637399bf7e77797811adf340090b561a8f9d1213",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/639c70352958735addbba5ae7dd65985da96e061",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}