CVE-2025-21716
CVSS 3.1 Score 5.5 of 10 (medium)
Details
Published Feb 27, 2025
Updated: Mar 7, 2025
CWE ID 908
Summary
CVE-2025-21716: A vulnerability in the Linux kernel's vxlan module has been addressed. The issue, identified by KMSAN, involved uninit-value access in the function vxlan_vnifilter_dump(). This occurred when the netlink message payload length was less than the size of the tunnel_msg struct, causing the function to access uninitialized memory. Consequences could include unpredictable behavior and potential crashes. The flaw was introduced during the allocation of a netlink_skb_t object, which was used in the netlink_sendmsg function call chain.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.