Input validation error in Linux kernel ethtool



| Updated: 2025-05-11
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2025-21921
CWE-ID CWE-20
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Input validation error

EUVDB-ID: #VU106805

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21921

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the strset_prepare_data() function in net/ethtool/strset.c, within the stats_prepare_data() function in net/ethtool/stats.c, within the pse_prepare_data() and ethnl_set_pse() functions in net/ethtool/pse-pd.c, within the plca_get_cfg_prepare_data(), ethnl_set_plca() and plca_get_status_prepare_data() functions in net/ethtool/plca.c, within the ethnl_phy_parse_request() function in net/ethtool/phy.c, within the ethnl_parse_header_dev_get() and ethnl_req_get_phydev() functions in net/ethtool/netlink.c, within the linkstate_prepare_data() function in net/ethtool/linkstate.c, within the ethnl_act_cable_test() and ethnl_act_cable_test_tdr() functions in net/ethtool/cabletest.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.12 - 6.12.18

CPE2.3 External links

https://git.kernel.org/stable/c/1f458fa42c29144cef280e05bc49fc21b873d897
https://git.kernel.org/stable/c/637399bf7e77797811adf340090b561a8f9d1213
https://git.kernel.org/stable/c/639c70352958735addbba5ae7dd65985da96e061
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.19


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###