cve/published/2025/CVE-2025-21981.mbox

From bippy-7c5fe7eed585 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2025-21981: ice: fix memory leak in aRFS after reset

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ice: fix memory leak in aRFS after reset

Fix aRFS (accelerated Receive Flow Steering) structures memory leak by
adding a checker to verify if aRFS memory is already allocated while
configuring VSI. aRFS objects are allocated in two cases:
- as part of VSI initialization (at probe), and
- as part of reset handling

However, VSI reconfiguration executed during reset involves memory
allocation one more time, without prior releasing already allocated
resources. This led to the memory leak with the following signature:

[root@os-delivery ~]# cat /sys/kernel/debug/kmemleak
unreferenced object 0xff3c1ca7252e6000 (size 8192):
  comm "kworker/0:0", pid 8, jiffies 4296833052
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    [<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340
    [<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice]
    [<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice]
    [<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice]
    [<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice]
    [<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice]
    [<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0
    [<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20
    [<ffffffff98f0b6d9>] process_one_work+0x179/0x390
    [<ffffffff98f0c1e9>] worker_thread+0x239/0x340
    [<ffffffff98f14abc>] kthread+0xcc/0x100
    [<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50
    [<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30
    ...

The Linux kernel CVE team has assigned CVE-2025-21981 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.8 with commit 28bf26724fdb0e02267d19e280d6717ee810a10d and fixed in 5.10.236 with commit ef2bc94059836a115430a6ad9d2838b0b34dc8f5
	Issue introduced in 5.8 with commit 28bf26724fdb0e02267d19e280d6717ee810a10d and fixed in 5.15.180 with commit e6902101f34f098af59b0d1d8cf90c4124c02c6a
	Issue introduced in 5.8 with commit 28bf26724fdb0e02267d19e280d6717ee810a10d and fixed in 6.1.132 with commit fcbacc47d16306c87ad1b820b7a575f6e9eae58b
	Issue introduced in 5.8 with commit 28bf26724fdb0e02267d19e280d6717ee810a10d and fixed in 6.6.84 with commit 5d30d256661fc11b6e73fac6c3783a702e1006a3
	Issue introduced in 5.8 with commit 28bf26724fdb0e02267d19e280d6717ee810a10d and fixed in 6.12.20 with commit 3b27e6e10a32589fcd293b8933ab6de9387a460e
	Issue introduced in 5.8 with commit 28bf26724fdb0e02267d19e280d6717ee810a10d and fixed in 6.13.8 with commit 78f3d64b30210c0e521c59357431aca14024cb79
	Issue introduced in 5.8 with commit 28bf26724fdb0e02267d19e280d6717ee810a10d and fixed in 6.14 with commit 23d97f18901ef5e4e264e3b1777fe65c760186b5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21981
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/intel/ice/ice_arfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ef2bc94059836a115430a6ad9d2838b0b34dc8f5
	https://git.kernel.org/stable/c/e6902101f34f098af59b0d1d8cf90c4124c02c6a
	https://git.kernel.org/stable/c/fcbacc47d16306c87ad1b820b7a575f6e9eae58b
	https://git.kernel.org/stable/c/5d30d256661fc11b6e73fac6c3783a702e1006a3
	https://git.kernel.org/stable/c/3b27e6e10a32589fcd293b8933ab6de9387a460e
	https://git.kernel.org/stable/c/78f3d64b30210c0e521c59357431aca14024cb79
	https://git.kernel.org/stable/c/23d97f18901ef5e4e264e3b1777fe65c760186b5