Cyber Resilience

CVE-2025-21926

Linux Kernel 4.18 – 5.4.291

Published
01 April 2025
Modified
14 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0021 11th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-21926 is a medium-severity an unspecified weakness vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and CM-7 (Least Functionality) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the…

more

original skb is later orphaned as we can hit the following bug: kernel BUG at ./include/linux/skbuff.h:3312! (skb_orphan) RIP: 0010:ip_rcv_core+0x8b2/0xca0 Call Trace: ip_rcv+0xab/0x6e0 __netif_receive_skb_one_core+0x168/0x1b0 process_backlog+0x384/0x1100 __napi_poll.constprop.0+0xa1/0x370 net_rx_action+0x925/0xe50 The above can happen following a sequence of events when using OpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an OVS_ACTION_ATTR_OUTPUT action: 1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb goes through queue_gso_packets and then __udp_gso_segment, where its destructor is removed. 2. The segments' data are copied and sent to userspace. 3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the same original skb is sent to its path. 4. If it later hits skb_orphan, we hit the bug. Fix this by also removing the reference to the socket in __udp_gso_segment.

CWE(s)
NVD-CWE-noinfo

Related Threats

CVEs Like This One

CVE-2023-1582Same product: Linux Linux Kernel
CVE-2023-52792Same product: Linux Linux Kernel
CVE-2024-35859Same product: Linux Linux Kernel
CVE-2023-52825Same product: Linux Linux Kernel
CVE-2024-56554Same product: Linux Linux Kernel
CVE-2024-56712Same product: Linux Linux Kernel
CVE-2024-43825Same product: Linux Linux Kernel
CVE-2023-52529Same product: Linux Linux Kernel
CVE-2024-42259Same product: Linux Linux Kernel
CVE-2024-26828Same product: Linux Linux Kernel

Affected Assets

linux
linux kernel
6.14 · 4.18 — 5.4.291 · 5.5 — 5.10.235 · 5.11 — 5.15.179

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)
  • SI-4 System Monitoring
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely application of the kernel patch that removes the lingering socket reference in __udp_gso_segment, eliminating the skb_orphan BUG.

CM-7 Least Functionality partial match
prevent

Least-functionality setting can disable UDP GSO (or Open vSwitch GSO offload paths) so the vulnerable __udp_gso_segment code path is never exercised.

SI-4 System Monitoring partial match
detect

Continuous monitoring of kernel oops/panic events and netif_receive_skb paths can detect the exact BUG triggered by the orphaned skb after OVS userspace actions.

References