cve/published/2025/CVE-2025-37865.mbox

From bippy-1.2.0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@kernel.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2025-37865: net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported

Russell King reports that on the ZII dev rev B, deleting a bridge VLAN
from a user port fails with -ENOENT:
https://lore.kernel.org/netdev/Z_lQXNP0s5-IiJzd@shell.armlinux.org.uk/

This comes from mv88e6xxx_port_vlan_leave() -> mv88e6xxx_mst_put(),
which tries to find an MST entry in &chip->msts associated with the SID,
but fails and returns -ENOENT as such.

But we know that this chip does not support MST at all, so that is not
surprising. The question is why does the guard in mv88e6xxx_mst_put()
not exit early:

	if (!sid)
		return 0;

And the answer seems to be simple: the sid comes from vlan.sid which
supposedly was previously populated by mv88e6xxx_vtu_get().
But some chip->info->ops->vtu_getnext() implementations do not populate
vlan.sid, for example see mv88e6185_g1_vtu_getnext(). In that case,
later in mv88e6xxx_port_vlan_leave() we are using a garbage sid which is
just residual stack memory.

Testing for sid == 0 covers all cases of a non-bridge VLAN or a bridge
VLAN mapped to the default MSTI. For some chips, SID 0 is valid and
installed by mv88e6xxx_stu_setup(). A chip which does not support the
STU would implicitly only support mapping all VLANs to the default MSTI,
so although SID 0 is not valid, it would be sufficient, if we were to
zero-initialize the vlan structure, to fix the bug, due to the
coincidence that a test for vlan.sid == 0 already exists and leads to
the same (correct) behavior.

Another option which would be sufficient would be to add a test for
mv88e6xxx_has_stu() inside mv88e6xxx_mst_put(), symmetric to the one
which already exists in mv88e6xxx_mst_get(). But that placement means
the caller will have to dereference vlan.sid, which means it will access
uninitialized memory, which is not nice even if it ignores it later.

So we end up making both modifications, in order to not rely just on the
sid == 0 coincidence, but also to avoid having uninitialized structure
fields which might get temporarily accessed.

The Linux kernel CVE team has assigned CVE-2025-37865 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.18 with commit acaf4d2e36b3466334af4d3ee6ac254c3316165c and fixed in 6.1.135 with commit 35cde75c08a1fa1a5ac0467afe2709caceeef002
	Issue introduced in 5.18 with commit acaf4d2e36b3466334af4d3ee6ac254c3316165c and fixed in 6.6.88 with commit afae9087301471970254a9180e5a26d3d8e8af09
	Issue introduced in 5.18 with commit acaf4d2e36b3466334af4d3ee6ac254c3316165c and fixed in 6.12.25 with commit 9ee6d3a368ed34f2457863da3085c676e9e37a3d
	Issue introduced in 5.18 with commit acaf4d2e36b3466334af4d3ee6ac254c3316165c and fixed in 6.14.4 with commit 9da4acbd60664271d34a627f7f63cd5bad8eba74
	Issue introduced in 5.18 with commit acaf4d2e36b3466334af4d3ee6ac254c3316165c and fixed in 6.15 with commit ea08dfc35f83cfc73493c52f63ae4f2e29edfe8d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-37865
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/dsa/mv88e6xxx/chip.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/35cde75c08a1fa1a5ac0467afe2709caceeef002
	https://git.kernel.org/stable/c/afae9087301471970254a9180e5a26d3d8e8af09
	https://git.kernel.org/stable/c/9ee6d3a368ed34f2457863da3085c676e9e37a3d
	https://git.kernel.org/stable/c/9da4acbd60664271d34a627f7f63cd5bad8eba74
	https://git.kernel.org/stable/c/ea08dfc35f83cfc73493c52f63ae4f2e29edfe8d