CVE-2025-21854

Summary

CVE-2025-21854 is a vulnerability affecting the Linux kernel's sockmap and vsock components. In this edge case, unconnected (connectible) sockets with no assigned transport may lose their previous transport assignment, leading to a NULL pointer dereference when handling these sockets in the vsock/BPF recv path. Listening vsocks, which should not have any transport assigned, may end up in the sockmap due to the socket's previous transport assignment during a failed connect() attempt. To mitigate this issue, the Linux kernel should only allow established connections for connectible sockets in the sockmap, which is the standard behavior for AF_INET and AF_UNIX sockets.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.