CVE-2025-21857

Summary

CVE-2025-21857 is a Linux kernel vulnerability that has been addressed. In the net/sched module, a NULL dereference occurred due to an error in the cls_api's error handling. The function tcf_exts_miss_cookie_base_alloc() uses xa_alloc_cyclic(), which can return 1 upon successful allocation after wrapping. This was treated as an error, causing tcf_exts_init_ex() to set nexts->actions to NULL and return 1 to fl_change(). However, fl_change() interprets err == 1 as a success, resulting in the dereferencing of exts->actions in tcf_action_init(). This vulnerability could lead to a kernel NULL pointer dereference.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.