LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21676: net: fec: handle page_pool_dev_alloc_pages error

In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd function calls page_pool_dev_alloc_pages but did not handle the case when it returned NULL. There was a WARN_ON(!new_page) but it would still proceed to use the NULL pointer and then crash. This case does seem somewhat rare but when the system is under memory pressure it can happen. One case where I can duplicate this with some frequency is when writing over a smbd share to a SATA HDD attached to an imx6q. Setting /proc/sys/vm/min_free_kbytes to higher values also seems to solve the problem for my test case. But it still seems wrong that the fec driver ignores the memory allocation error and can crash. This commit handles the allocation error by dropping the current packet.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux Ethernet driver can crash the system when memory is scarce because it continues after a page allocation fails. The impact is loss of availability, not disclosed data theft or modification. The source describes the condition as rare but reproducible during heavy storage and network activity on an i.MX6Q system.

Executive priority

Prioritize affected embedded or operational systems where an unexpected reboot disrupts essential services. Patch during the next expedited maintenance window, sooner for memory-constrained or historically unstable devices. Internet exposure alone does not prove exploitability; asset-specific driver usage and kernel provenance should drive urgency.

Technical view

The Linux FEC Ethernet driver’s fec_enet_update_cbd function failed to stop when page_pool_dev_alloc_pages returned NULL. It warned, dereferenced the NULL pointer, and could crash the kernel. The published correction handles the allocation failure by dropping the current packet. This is CWE-476 with CVSS 3.1 score 7.5 for availability impact.

Likely exposure

Exposure is most likely on Linux systems using the FEC Ethernet driver, particularly memory-constrained embedded platforms under pressure. The supplied record identifies affected Linux versions including 6.1, 6.1.167, 6.6.74, 6.12.11, and 6.13, but its version data is ambiguous; verify exact vendor kernel builds.

Exploitation context

The supplied record does not list this CVE in KEV, and no provided source establishes active exploitation. Triggering requires the vulnerable FEC path alongside a failed page allocation. Although the CVSS vector marks network reachability, the bundle does not demonstrate reliable remote attacker control of the necessary memory-pressure condition.

Researcher notes

The failure is a NULL-pointer dereference following an unchecked page-pool allocation error. The disclosed reproducer context involved writing through an SMB Direct share to SATA storage on i.MX6Q under memory pressure. The bundle supports denial of service only. Exact affected ranges and downstream backports require vendor-specific confirmation.

Mitigation direction

  • Apply a vendor-supported kernel containing the referenced stable fix.
  • Confirm the deployed kernel backport specifically handles failed FEC page allocation.
  • If patching is delayed, review vendor guidance for platform-specific mitigations.
  • Treat increased min_free_kbytes only as a temporary operational workaround, not a confirmed fix.

Validation and detection

  • Inventory systems using the Linux FEC Ethernet driver.
  • Map each running kernel build to vendor advisories and stable fixes.
  • Confirm the corrected path drops the packet when page allocation fails.
  • Monitor affected devices for kernel warnings, NULL dereferences, crashes, or unexplained reboots.
  • Test under representative memory, network, and storage pressure after updating.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-476: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-21676 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2025-21676Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux95698ff6177b5f1f13f251da60e7348413046ae4, 95698ff6177b5f1f13f251da60e7348413046ae4, 95698ff6177b5f1f13f251da60e7348413046ae4, 95698ff6177b5f1f13f251da60e7348413046ae4unaffected
LinuxLinux6.1, 0, 6.1.167, 6.6.74, 6.12.11, 6.13affected
Weakness

CWE details

CWE-476

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-476 · source CWE mapping

NULL Pointer Dereference

NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs