Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2025-21670: Linux kernel crash when virtual socket has no transport
CVE-2025-21670 · published 1 year ago
Summary
The Linux kernel can crash if a virtual socket tries to receive data while its connection information is missing, such as after a failed connection attempt. This issue affects several Linux kernel packages, including standard and cloud‑focused builds. Apply the latest kernel updates from your Linux distribution to install the fix and prevent crashes.
What to do
- Update canonical linux-aws-6.8 to version 6.8.0-1030.32~22.04.1.
- Update canonical linux-azure-6.8 to version 6.8.0-1030.35~22.04.1.
- Update canonical linux-gcp-6.8 to version 6.8.0-1031.33~22.04.1.
- Update canonical linux-hwe-6.8 to version 6.8.0-64.67~22.04.1.
- Update canonical linux-ibm-6.8 to version 6.8.0-1027.27~22.04.1.
- Update canonical linux-lowlatency-hwe-6.8 to version 6.8.0-62.65.1~22.04.1.
- Update canonical linux-nvidia-6.8 to version 6.8.0-1029.32~22.04.1.
- Update canonical linux-oracle-6.8 to version 6.8.0-1027.28~22.04.1.
- Update canonical linux-riscv-6.8 to version 6.8.0-62.65~22.04.1.
- Update canonical linux-realtime-6.8 to version 6.8.1-1023.24~22.04.1.
- Update canonical linux to version 6.8.0-62.65.
- Update canonical linux-aws to version 6.8.0-1030.32.
- Update canonical linux-azure to version 6.8.0-1030.35.
- Update canonical linux-azure-6.11 to version 6.11.0-1013.13~24.04.1.
- Update canonical linux-azure-nvidia to version 6.8.0-1018.19.
- Update canonical linux-gcp to version 6.8.0-1031.33.
- Update canonical linux-gcp-6.11 to version 6.11.0-1013.13~24.04.1.
- Update canonical linux-gke to version 6.8.0-1026.30.
- Update canonical linux-gkeop to version 6.8.0-1013.15.
- Update canonical linux-hwe-6.11 to version 6.11.0-24.24~24.04.1.
- Update canonical linux-ibm to version 6.8.0-1027.27.
- Update canonical linux-lowlatency to version 6.8.0-62.65.1.
- Update canonical linux-lowlatency-hwe-6.11 to version 6.11.0-1012.13~24.04.1.
- Update canonical linux-nvidia to version 6.8.0-1029.32.
- Update canonical linux-nvidia-6.11 to version 6.11.0-1007.7.
- Update canonical linux-nvidia-lowlatency to version 6.8.0-1029.32.1.
- Update canonical linux-nvidia-tegra to version 6.8.0-1008.8.
- Update canonical linux-oem-6.11 to version 6.11.0-1020.20.
- Update canonical linux-oem-6.8 to version 6.8.0-1029.29.
- Update canonical linux-oracle to version 6.8.0-1027.28.
- Update canonical linux-raspi to version 6.8.0-1029.33.
- Update canonical linux-xilinx to version 6.8.0-1017.18.
- Update canonical linux-raspi-realtime to version 6.8.0-2024.25.
- Update canonical linux-realtime to version 6.8.1-1023.24.
- Update canonical linux-fips to version 6.8.0-78.78+fips1.
- Update linux kernel to version 6.12.11.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 6.4, < 6.6.74 >= 6.7, < 6.12.11 6.13 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.8 |
< 6.8.0-1030.32~22.04.1 Fix: upgrade to 6.8.0-1030.32~22.04.1
|
Showing 50 of 114. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.8 |
< 6.8.0-1030.35~22.04.1 Fix: upgrade to 6.8.0-1030.35~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.8 |
< 6.8.0-1031.33~22.04.1 Fix: upgrade to 6.8.0-1031.33~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.8 |
< 6.8.0-64.67~22.04.1 Fix: upgrade to 6.8.0-64.67~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-ibm-6.8 |
< 6.8.0-1027.27~22.04.1 Fix: upgrade to 6.8.0-1027.27~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.8 |
< 6.8.0-62.65.1~22.04.1 Fix: upgrade to 6.8.0-62.65.1~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.8 |
< 6.8.0-1029.32~22.04.1 Fix: upgrade to 6.8.0-1029.32~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.8 |
< 6.8.0-1027.28~22.04.1 Fix: upgrade to 6.8.0-1027.28~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.8 |
< 6.8.0-62.65~22.04.1 Fix: upgrade to 6.8.0-62.65~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime-6.8 |
< 6.8.1-1023.24~22.04.1 Fix: upgrade to 6.8.1-1023.24~22.04.1
|
| Ubuntu:24.04:LTS | canonical | linux |
< 6.8.0-62.65 Fix: upgrade to 6.8.0-62.65
|
| Ubuntu:24.04:LTS | canonical | linux-aws |
< 6.8.0-1030.32 Fix: upgrade to 6.8.0-1030.32
|
| Ubuntu:24.04:LTS | canonical | linux-azure |
< 6.8.0-1030.35 Fix: upgrade to 6.8.0-1030.35
|
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 |
< 6.11.0-1013.13~24.04.1 Fix: upgrade to 6.11.0-1013.13~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia |
< 6.8.0-1018.19 Fix: upgrade to 6.8.0-1018.19
|
| Ubuntu:24.04:LTS | canonical | linux-gcp |
< 6.8.0-1031.33 Fix: upgrade to 6.8.0-1031.33
|
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 |
< 6.11.0-1013.13~24.04.1 Fix: upgrade to 6.11.0-1013.13~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-gke |
< 6.8.0-1026.30 Fix: upgrade to 6.8.0-1026.30
|
| Ubuntu:24.04:LTS | canonical | linux-gkeop |
< 6.8.0-1013.15 Fix: upgrade to 6.8.0-1013.15
|
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 |
< 6.11.0-24.24~24.04.1 Fix: upgrade to 6.11.0-24.24~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-ibm |
< 6.8.0-1027.27 Fix: upgrade to 6.8.0-1027.27
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency |
< 6.8.0-62.65.1 Fix: upgrade to 6.8.0-62.65.1
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 |
< 6.11.0-1012.13~24.04.1 Fix: upgrade to 6.11.0-1012.13~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia |
< 6.8.0-1029.32 Fix: upgrade to 6.8.0-1029.32
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 |
< 6.11.0-1007.7 Fix: upgrade to 6.11.0-1007.7
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-lowlatency |
< 6.8.0-1029.32.1 Fix: upgrade to 6.8.0-1029.32.1
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-tegra |
< 6.8.0-1008.8 Fix: upgrade to 6.8.0-1008.8
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 |
< 6.11.0-1020.20 Fix: upgrade to 6.11.0-1020.20
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 |
< 6.8.0-1029.29 Fix: upgrade to 6.8.0-1029.29
|
| Ubuntu:24.04:LTS | canonical | linux-oracle |
< 6.8.0-1027.28 Fix: upgrade to 6.8.0-1027.28
|
| Ubuntu:24.04:LTS | canonical | linux-raspi |
< 6.8.0-1029.33 Fix: upgrade to 6.8.0-1029.33
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-xilinx |
< 6.8.0-1017.18 Fix: upgrade to 6.8.0-1017.18
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-raspi-realtime |
< 6.8.0-2024.25 Fix: upgrade to 6.8.0-2024.25
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime |
< 6.8.1-1023.24 Fix: upgrade to 6.8.1-1023.24
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-fips |
< 6.8.0-78.78+fips1 Fix: upgrade to 6.8.0-78.78+fips1
|
| Linux | linux | kernel |
>= 6.7.0, < 6.12.11 Fix: upgrade to 6.12.11
|
Original advisory text
vsock/bpf: return early if transport is not assigned
In the Linux kernel, the following vulnerability has been resolved:
vsock/bpf: return early if transport is not assigned
Some of the core functions can only be called if the transport
has been assigned.
As Michal reported, a socket might have the transport at NULL,
for example after a failed connect(), causing the following trace:
BUG: kernel NULL pointer dereference, address: 00000000000000a0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0
Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+
RIP: 0010:vsock_connectible_has_data+0x1f/0x40
Call Trace:
vsock_bpf_recvmsg+0xca/0x5e0
sock_recvmsg+0xb9/0xc0
__sys_recvfrom+0xb3/0x130
__x64_sys_recvfrom+0x20/0x30
do_syscall_64+0x93/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e
So we need to check the `vsk->transport` in vsock_bpf_recvmsg(),
especially for connected sockets (stream/seqpacket) as we already
do in __vsock_connectible_recvmsg().
vsock/bpf: return early if transport is not assigned
Some of the core functions can only be called if the transport
has been assigned.
As Michal reported, a socket might have the transport at NULL,
for example after a failed connect(), causing the following trace:
BUG: kernel NULL pointer dereference, address: 00000000000000a0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0
Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+
RIP: 0010:vsock_connectible_has_data+0x1f/0x40
Call Trace:
vsock_bpf_recvmsg+0xca/0x5e0
sock_recvmsg+0xb9/0xc0
__sys_recvfrom+0xb3/0x130
__x64_sys_recvfrom+0x20/0x30
do_syscall_64+0x93/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e
So we need to check the `vsk->transport` in vsock_bpf_recvmsg(),
especially for connected sockets (stream/seqpacket) as we already
do in __vsock_connectible_recvmsg().
References
- https://git.kernel.org/stable/c/58e586c30d0b6f5dc0174a41026f2b0a48c9aab6 URL
- https://git.kernel.org/stable/c/6771e1279dadf1d92a72e1465134257d9e6f2459 URL
- https://git.kernel.org/stable/c/f6abafcd32f9cfc4b1a2f820ecea70773e26d423 URL
- https://ubuntu.com/security/CVE-2025-21670 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-21670 Third Party Advisory
- https://git.kernel.org/linus/f6abafcd32f9cfc4b1a2f820ecea70773e26d423 Third Party Advisory
- https://ubuntu.com/security/notices/USN-7445-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7448-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7595-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7596-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7595-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7596-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7595-3 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7595-4 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7595-5 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7653-1 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21670... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-21670 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published31 Jan 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta