Linux Kernel up to 5.15.176/6.1.126/6.6.73/6.12.10 net/core/pktgen.c get_imix_entries array index

Summaryinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 5.15.176/6.1.126/6.6.73/6.12.10. This issue affects the function get_imix_entries in the library lib/dump_stack.c of the file net/core/pktgen.c. This manipulation causes array index. This vulnerability is registered as CVE-2025-21680. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.15.176/6.1.126/6.6.73/6.12.10. Affected by this vulnerability is the function get_imix_entries in the library lib/dump_stack.c of the file net/core/pktgen.c. The manipulation with an unknown input leads to a array index vulnerability. The CWE definition for the vulnerability is CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: pktgen: Avoid out-of-bounds access in get_imix_entries Passing a sufficient amount of imix entries leads to invalid access to the pkt_dev->imix_entries array because of the incorrect boundary check. UBSAN: array-index-out-of-bounds in net/core/pktgen.c:874:24 index 20 is out of range for type 'imix_pkt [20]' CPU: 2 PID: 1210 Comm: bash Not tainted 6.10.0-rc1 #121 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: dump_stack_lvl lib/dump_stack.c:117 __ubsan_handle_out_of_bounds lib/ubsan.c:429 get_imix_entries net/core/pktgen.c:874 pktgen_if_write net/core/pktgen.c:1063 pde_write fs/proc/inode.c:334 proc_reg_write fs/proc/inode.c:346 vfs_write fs/read_write.c:593 ksys_write fs/read_write.c:644 do_syscall_64 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:130 Found by Linux Verification Center (linuxtesting.org) with SVACE. [ fp: allow to fill the array completely; minor changelog cleanup ]

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2025-21680 since 12/29/2024. The exploitation appears to be difficult. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/17/2026).

The vulnerability scanner Nessus provides a plugin with the ID 215144 (Debian dsa-5860 : affs-modules-6.1.0-21-4kc-malta-di - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.15.177, 6.1.127, 6.6.74 or 6.12.11 eliminates this vulnerability. Applying the patch 3450092cc2d1c311c5ea92a2486daa2a33520ea5/e5d24a7074dcd0c7e76b7e7e4efbbe7418d62486/7cde21f52042aa2e29a654458166b873d2ae66b3/1a9b65c672ca9dc4ba52ca2fd54329db9580ce29/76201b5979768500bca362871db66d77cb4c225e is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (215144) and CERT Bund (WID-SEC-2025-0232). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• Dell NetWorker
• Dell Avamar
• Dell PowerProtect Data Domain
• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.15.176
• 6.1.126
• 6.6.0
• 6.6.1
• 6.6.2
• 6.6.3
• 6.6.4
• 6.6.5
• 6.6.6
• 6.6.7
• 6.6.8
• 6.6.9
• 6.6.10
• 6.6.11
• 6.6.12
• 6.6.13
• 6.6.14
• 6.6.15
• 6.6.16
• 6.6.17
• 6.6.18
• 6.6.19
• 6.6.20
• 6.6.21
• 6.6.22
• 6.6.23
• 6.6.24
• 6.6.25
• 6.6.26
• 6.6.27
• 6.6.28
• 6.6.29
• 6.6.30
• 6.6.31
• 6.6.32
• 6.6.33
• 6.6.34
• 6.6.35
• 6.6.36
• 6.6.37
• 6.6.38
• 6.6.39
• 6.6.40
• 6.6.41
• 6.6.42
• 6.6.43
• 6.6.44
• 6.6.45
• 6.6.46
• 6.6.47
• 6.6.48
• 6.6.49
• 6.6.50
• 6.6.51
• 6.6.52
• 6.6.53
• 6.6.54
• 6.6.55
• 6.6.56
• 6.6.57
• 6.6.58
• 6.6.59
• 6.6.60
• 6.6.61
• 6.6.62
• 6.6.63
• 6.6.64
• 6.6.65
• 6.6.66
• 6.6.67
• 6.6.68
• 6.6.69
• 6.6.70
• 6.6.71
• 6.6.72
• 6.6.73
• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4
• 6.12.5
• 6.12.6
• 6.12.7
• 6.12.8
• 6.12.9
• 6.12.10

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion