CVE-2025-22106
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: unregister xdp rxq info in the reset path vmxnet3 does not unregister xdp rxq info in the vmxnet3_reset_work() code path as vmxnet3_rq_destroy() is not invoked in this code path. So, we get below message with a backtrace. Missing unregister, handled but fix driver WARNING: CPU:48 PID: 500 at net/core/xdp.c:182 __xdp_rxq_info_reg+0x93/0xf0 This patch fixes the problem by moving the unregister code of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup().
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-04-16 15:16:04.913000
Last modified
2026-11-05 21:17:48.980000
View original CVE JSON
{
"id": "CVE-2025-22106",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-04-16T15:16:04.913",
"lastModified": "2026-11-05T21:17:48.980",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: unregister xdp rxq info in the reset path\n\nvmxnet3 does not unregister xdp rxq info in the\nvmxnet3_reset_work() code path as vmxnet3_rq_destroy()\nis not invoked in this code path. So, we get below message with a\nbacktrace.\n\nMissing unregister, handled but fix driver\nWARNING: CPU:48 PID: 500 at net/core/xdp.c:182\n__xdp_rxq_info_reg+0x93/0xf0\n\nThis patch fixes the problem by moving the unregister\ncode of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup()."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vmxnet3: anular el registro de la información de xdp rxq en la ruta de reinicio vmxnet3 no anula el registro de la información de xdp rxq en la ruta de código vmxnet3_reset_work() ya que vmxnet3_rq_destroy() no se invoca en esta ruta de código. Por lo tanto, obtenemos el siguiente mensaje con un backtrace. Falta anulación del registro, gestionada pero corregida el controlador ADVERTENCIA: CPU:48 PID: 500 en net/core/xdp.c:182 __xdp_rxq_info_reg+0x93/0xf0 Este parche corrige el problema moviendo el código de anulación del registro de XDP de vmxnet3_rq_destroy() a vmxnet3_rq_cleanup()."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/vmxnet3/vmxnet3_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
"lessThan": "a6157484bee3385a425d288a69e1eaf03232f5fc",
"versionType": "git",
"status": "affected"
},
{
"version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
"lessThan": "23da4e0bb2a38966d29db0ff90a8fe68fdfa1744",
"versionType": "git",
"status": "affected"
},
{
"version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
"lessThan": "9908541a9e235b7c5e2fbdd59910eaf9c32c3075",
"versionType": "git",
"status": "affected"
},
{
"version": "54f00cce11786742bd11e5e68c3bf85e6dc048c9",
"lessThan": "0dd765fae295832934bf28e45dd5a355e0891ed4",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/vmxnet3/vmxnet3_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.6",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.108",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.49",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.14.2",
"lessThanOrEqual": "6.14.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.15",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-05T20:38:49.842592Z",
"id": "CVE-2025-22106",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6",
"versionEndExcluding": "6.6.108",
"matchCriteriaId": "6014655E-7044-4F9B-B5E6-497BDF9C2DBF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.49",
"matchCriteriaId": "CAA033E9-A2C5-4976-A83E-9804D8FB827F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.14.2",
"matchCriteriaId": "633A38C1-75C8-452D-8F1C-DA0269FD2687"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/0dd765fae295832934bf28e45dd5a355e0891ed4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/23da4e0bb2a38966d29db0ff90a8fe68fdfa1744",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9908541a9e235b7c5e2fbdd59910eaf9c32c3075",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a6157484bee3385a425d288a69e1eaf03232f5fc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}