SB2025040290 - Input validation error in Linux kernel ethtool

Description

This security bulletin contains information about 1 security vulnerability.

1) Input validation error (CVE-ID: CVE-2025-21921)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the strset_prepare_data() function in net/ethtool/strset.c, within the stats_prepare_data() function in net/ethtool/stats.c, within the pse_prepare_data() and ethnl_set_pse() functions in net/ethtool/pse-pd.c, within the plca_get_cfg_prepare_data(), ethnl_set_plca() and plca_get_status_prepare_data() functions in net/ethtool/plca.c, within the ethnl_phy_parse_request() function in net/ethtool/phy.c, within the ethnl_parse_header_dev_get() and ethnl_req_get_phydev() functions in net/ethtool/netlink.c, within the linkstate_prepare_data() function in net/ethtool/linkstate.c, within the ethnl_act_cable_test() and ethnl_act_cable_test_tdr() functions in net/ethtool/cabletest.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1f458fa42c29144cef280e05bc49fc21b873d897
• https://git.kernel.org/stable/c/637399bf7e77797811adf340090b561a8f9d1213
• https://git.kernel.org/stable/c/639c70352958735addbba5ae7dd65985da96e061
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.19