7.8

CVE-2025-21926: linux

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2025-21926DEBIAN-CVE-2025-21926
Published 01-04-2025Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2025-21926 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.9% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 64 · Related 59
DLA-4178-1DLA-4193-1DSA-5900-1RHSA-2025:8643RHSA-2025:8669SUSE-SU-2025:01600-1

Timeline

  1. 01-04-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the following bug: kernel BUG at ./include/linux/skbuff.h:3312! (skb_orphan) RIP: 0010:ip_rcv_core+0x8b2/0xca0 Call Trace: ip_rcv+0xab/0x6e0 __netif_receive_skb_one_core+0x168/0x1b0 process_backlog+0x384/0x1100 __napi_poll.constprop.0+0xa1/0x370 net_rx_action+0x925/0xe50 The above can happen following a sequence of events when using OpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an OVS_ACTION_ATTR_OUTPUT action: 1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb goes through queue_gso_packets and then __udp_gso_segment, where its destructor is removed. 2. The segments' data are copied and sent to userspace. 3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the same original skb is sent to its path. 4. If it later hits skb_orphan, we hit the bug. Fix this by also removing the reference to the socket in __udp_gso_segment.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu133 products
  • linux< 5.4.0-216.236 | < 5.15.0-140.150 | < 6.8.0-84.84
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.4.0-1146.156 | < 5.15.0-1084.91 | < 6.8.0-1039.41
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ ad405857b174ed31a97982bb129c320d03321cf5, < 9f28205ddb76e86cac418332e952241d85fed0dc | ≥ ad405857b174ed31a97982bb129c320d03321cf5, < a2d1cca955ed34873e524cc2e6e885450d262f05 | ≥ ad405857b174ed31a97982bb129c320d03321cf5, < 455217ac9db0cf9349b3933664355e907bb1a569 | ≥ ad405857b174ed31a97982bb129c320d03321cf5, < e8db70537878e1bb3fd83e5abcc6feefc0587828 | ≥ ad405857b174ed31a97982bb129c320d03321cf5, < 01a83237644d6822bc7df2c5564fc81b0df84358 | ≥ ad405857b174ed31a97982bb129c320d03321cf5, < 084819b0d8b1bd433b90142371eb9450d657f8ca | ≥ ad405857b174ed31a97982bb129c320d03321cf5, < c32da44cc9298eaa6109e3fc2c2b4e07cc4bf11b | ≥ ad405857b174ed31a97982bb129c320d03321cf5, < ee01b2f2d7d0010787c2343463965bbc283a497f | 4.18
  • linux_kernel≥ 4.18, < 5.4.291 | ≥ 5.5, < 5.10.235 | ≥ 5.11, < 5.15.179 | ≥ 5.16, < 6.1.131 | ≥ 6.2, < 6.6.83 | ≥ 6.7, < 6.12.19 | ≥ 6.13, < 6.13.7 | 6.14:rc1 | 6.14:rc2 | 6.14:rc3 | 6.14:rc4 | 6.14:rc5
Debian1 product
  • linux< 6.1.133-1 | < 6.12.19-1

3 vendors · 136 products

References

64 links
Show all 64 references