CVE-2025-21920

Summary

CVE-2025-21920 is a vulnerability affecting the Linux kernel that allows the creation of VLAN devices on non-ethernet devices, resulting in an out-of-bounds read issue. During VLAN device initialization, the length of multicast addresses provided by GARP and MRP is incorrectly used to determine the length of the underlying device's address, leading to a buffer overflow. Consequently, the address of a kernel function, garp_pdu_rcv, is leaked to usermode. This vulnerability can be exploited by creating a VLAN device on a non-ethernet interface with a long multicast address, causing an out-of-bounds read. The issue has been resolved by enforcing the type of the underlying device during VLAN device initialization.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.