{"id":"DEBIAN-CVE-2025-21925","details":"In the Linux kernel, the following vulnerability has been resolved:  llc: do not use skb_get() before dev_queue_xmit()  syzbot is able to crash hosts [1], using llc and devices not supporting IFF_TX_SKB_SHARING.  In this case, e1000 driver calls eth_skb_pad(), while the skb is shared.  Simply replace skb_get() by skb_clone() in net/llc/llc_s_ac.c  Note that e1000 driver might have an issue with pktgen, because it does not clear IFF_TX_SKB_SHARING, this is an orthogonal change.  We need to audit other skb_get() uses in net/llc.  [1]  kernel BUG at net/core/skbuff.c:2178 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 16371 Comm: syz.2.2764 Not tainted 6.14.0-rc4-syzkaller-00052-gac9c34d1e45a #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014  RIP: 0010:pskb_expand_head+0x6ce/0x1240 net/core/skbuff.c:2178 Call Trace:  \u003cTASK\u003e   __skb_pad+0x18a/0x610 net/core/skbuff.c:2466   __skb_put_padto include/linux/skbuff.h:3843 [inline]   skb_put_padto include/linux/skbuff.h:3862 [inline]   eth_skb_pad include/linux/etherdevice.h:656 [inline]   e1000_xmit_frame+0x2d99/0x5800 drivers/net/ethernet/intel/e1000/e1000_main.c:3128   __netdev_start_xmit include/linux/netdevice.h:5151 [inline]   netdev_start_xmit include/linux/netdevice.h:5160 [inline]   xmit_one net/core/dev.c:3806 [inline]   dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3822   sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343   __dev_xmit_skb net/core/dev.c:4045 [inline]   __dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4621   dev_queue_xmit include/linux/netdevice.h:3313 [inline]   llc_sap_action_send_test_c+0x268/0x320 net/llc/llc_s_ac.c:144   llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]   llc_sap_next_state net/llc/llc_sap.c:182 [inline]   llc_sap_state_process+0x239/0x510 net/llc/llc_sap.c:209   llc_ui_sendmsg+0xd0d/0x14e0 net/llc/af_llc.c:993   sock_sendmsg_nosec net/socket.c:718 [inline]","modified":"2026-09-01T16:06:10.331688669Z","published":"2025-04-01T16:15:23.227Z","upstream":["CVE-2025-21925"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21925"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.133-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21925.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.19-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21925.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.19-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21925.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}