{"id":"DEBIAN-CVE-2025-21868","details":"In the Linux kernel, the following vulnerability has been resolved:  net: allow small head cache usage with large MAX_SKB_FRAGS values  Sabrina reported the following splat:      WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0     Modules linked in:     CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.14.0-rc1-net-00092-g011b03359038 #996     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014     RIP: 0010:netif_napi_add_weight_locked+0x8f2/0xba0     Code: e8 c3 e6 6a fe 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc c7 44 24 10 ff ff ff ff e9 8f fb ff ff e8 9e e6 6a fe \u003c0f\u003e 0b e9 d3 fe ff ff e8 92 e6 6a fe 48 8b 04 24 be ff ff ff ff 48     RSP: 0000:ffffc9000001fc60 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88806ce48128 RCX: 1ffff11001664b9e     RDX: ffff888008f00040 RSI: ffffffff8317ca42 RDI: ffff88800b325cb6     RBP: ffff88800b325c40 R08: 0000000000000001 R09: ffffed100167502c     R10: ffff88800b3a8163 R11: 0000000000000000 R12: ffff88800ac1c168     R13: ffff88800ac1c168 R14: ffff88800ac1c168 R15: 0000000000000007     FS:  0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: ffff888008201000 CR3: 0000000004c94001 CR4: 0000000000370ef0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400     Call Trace:     \u003cTASK\u003e     gro_cells_init+0x1ba/0x270     xfrm_input_init+0x4b/0x2a0     xfrm_init+0x38/0x50     ip_rt_init+0x2d7/0x350     ip_init+0xf/0x20     inet_init+0x406/0x590     do_one_initcall+0x9d/0x2e0     do_initcalls+0x23b/0x280     kernel_init_freeable+0x445/0x490     kernel_init+0x20/0x1d0     ret_from_fork+0x46/0x80     ret_from_fork_asm+0x1a/0x30     \u003c/TASK\u003e     irq event stamp: 584330     hardirqs last  enabled at (584338): [\u003cffffffff8168bf87\u003e] __up_console_sem+0x77/0xb0     hardirqs last disabled at (584345): [\u003cffffffff8168bf6c\u003e] __up_console_sem+0x5c/0xb0     softirqs last  enabled at (583242): [\u003cffffffff833ee96d\u003e] netlink_insert+0x14d/0x470     softirqs last disabled at (583754): [\u003cffffffff8317c8cd\u003e] netif_napi_add_weight_locked+0x77d/0xba0  on kernel built with MAX_SKB_FRAGS=45, where SKB_WITH_OVERHEAD(1024) is smaller than GRO_MAX_HEAD.  Such built additionally contains the revert of the single page frag cache so that napi_get_frags() ends up using the page frag allocator, triggering the splat.  Note that the underlying issue is independent from the mentioned revert; address it ensuring that the small head cache will fit either TCP and GRO allocation and updating napi_alloc_skb() and __netdev_alloc_skb() to select kmalloc() usage for any allocation fitting such cache.","modified":"2026-08-27T23:05:27.025230017Z","published":"2025-03-27T14:15:47.873Z","upstream":["CVE-2025-21868"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21868"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.17-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21868.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.17-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21868.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}