CVE-2025-21852

Summary

CVE-2025-21852 is a Linux kernel vulnerability that allows a BPF program to trigger a null-pointer dereference. This issue occurs due to the addition of an optional rx_sk to trace_kfree_skb without proper validation. Yan Zhai discovered that if the BPF program does not check if rx_sk is NULL, it could lead to a null pointer dereference and memory access violation. To address this issue, kfree_skb is added to raw_tp_null_args[] to prevent such programs from being loaded. This patch requires the commit 838a10bd2ebf to augment raw_tp arguments with PTR_MAYBE_NULL. The vulnerability results in a kernel NULL pointer dereference, leading to a system crash.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.