{"id":"DEBIAN-CVE-2025-21852","details":"In the Linux kernel, the following vulnerability has been resolved:  net: Add rx_skb of kfree_skb to raw_tp_null_args[].  Yan Zhai reported a BPF prog could trigger a null-ptr-deref [0] in trace_kfree_skb if the prog does not check if rx_sk is NULL.  Commit c53795d48ee8 (\"net: add rx_sk to trace_kfree_skb\") added rx_sk to trace_kfree_skb, but rx_sk is optional and could be NULL.  Let's add kfree_skb to raw_tp_null_args[] to let the BPF verifier validate such a prog and prevent the issue.  Now we fail to load such a prog:    libbpf: prog 'drop': -- BEGIN PROG LOAD LOG --   0: R1=ctx() R10=fp0   ; int BPF_PROG(drop, struct sk_buff *skb, void *location, @ kfree_skb_sk_null.bpf.c:21   0: (79) r3 = *(u64 *)(r1 +24)   func 'kfree_skb' arg3 has btf_id 5253 type STRUCT 'sock'   1: R1=ctx() R3_w=trusted_ptr_or_null_sock(id=1)   ; bpf_printk(\"sk: %d, %d\\n\", sk, sk-\u003e__sk_common.skc_family); @ kfree_skb_sk_null.bpf.c:24   1: (69) r4 = *(u16 *)(r3 +16)   R3 invalid mem access 'trusted_ptr_or_null_'   processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0   -- END PROG LOAD LOG --  Note this fix requires commit 838a10bd2ebf (\"bpf: Augment raw_tp arguments with PTR_MAYBE_NULL\").  [0]: BUG: kernel NULL pointer dereference, address: 0000000000000010  PF: supervisor read access in kernel mode  PF: error_code(0x0000) - not-present page PGD 0 P4D 0 PREEMPT SMP RIP: 0010:bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d Call Trace:  \u003cTASK\u003e  ? __die+0x1f/0x60  ? page_fault_oops+0x148/0x420  ? search_bpf_extables+0x5b/0x70  ? fixup_exception+0x27/0x2c0  ? exc_page_fault+0x75/0x170  ? asm_exc_page_fault+0x22/0x30  ? bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d  bpf_trace_run4+0x68/0xd0  ? unix_stream_connect+0x1f4/0x6f0  sk_skb_reason_drop+0x90/0x120  unix_stream_connect+0x1f4/0x6f0  __sys_connect+0x7f/0xb0  __x64_sys_connect+0x14/0x20  do_syscall_64+0x47/0xc30  entry_SYSCALL_64_after_hwframe+0x4b/0x53","modified":"2026-08-27T23:05:12.166559903Z","published":"2025-03-12T10:15:17.927Z","upstream":["CVE-2025-21852"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21852"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.17-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21852.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.17-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21852.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}