CVE-2025-21808

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21808", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.772Z", "datePublished": "2025-02-27T20:01:00.328Z", "dateUpdated": "2026-10-15T21:51:53.117Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:35.691Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xdp: Disallow attaching device-bound programs in generic mode\n\nDevice-bound programs are used to support RX metadata kfuncs. These\nkfuncs are driver-specific and rely on the driver context to read the\nmetadata. This means they can't work in generic XDP mode. However, there\nis no check to disallow such programs from being attached in generic\nmode, in which case the metadata kfuncs will be called in an invalid\ncontext, leading to crashes.\n\nFix this by adding a check to disallow attaching device-bound programs\nin generic mode."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local syscalls \u2014 bpf(BPF_PROG_LOAD) to create the device-bound program and netlink/BPF-link attach with XDP_FLAGS_SKB_MODE \u2014 before any packet can trigger the bad kfunc call. The packet trigger can be self-generated on a locally created veth pair, so no network position is needed.\nAC:L - The sequence is fully deterministic and attacker-controlled: create a veth pair, load a dev-bound XDP program calling bpf_xdp_metadata_rx_hash(), attach it in generic mode, then send one frame. No race, no special hardware, and the attacker can groom the kernel stack to control the value the driver callback consumes.\nPR:L - The attach side needs only CAP_NET_ADMIN in the target netns, which any unprivileged user obtains via `unshare -Urn`, and BPF program loading is reachable at low privilege in the delegated-BPF-token container deployments this feature targets. Consistent with kernel.org CNA scoring of other BPF program-loading vulnerabilities.\nUI:N - The attacker performs every step \u2014 program load, generic-mode attach, and packet injection \u2014 with no action by any other user or administrator.\nS:U - The wild-pointer read and write occur in kernel memory within the same security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The driver kfuncs dereference an uninitialized stack value as a driver-context pointer and return the loaded kernel memory (mlx5 CQE timestamp, ice RSS hash, veth skb_hwtstamps) into the BPF program, which exports it to userspace \u2014 a kernel-memory read primitive plus stack-content and KASLR disclosure.\nI:H - veth_xdp_rx_hash() reaches __skb_set_sw_hash() and stores through the bogus skb pointer, giving a write at an attacker-influenceable kernel address; combined with the read primitive this is exploitable memory corruption.\nA:H - Dereferencing a stale stack value as a driver descriptor/skb pointer in softirq (NAPI) context reliably oopses or panics the kernel, and the commit message explicitly states the invalid kfunc context leads to crashes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/dev.c"], "versions": [{"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "b1bc4a35a04cbeb85b6ef5911ec015baa424989f", "status": "affected", "versionType": "git"}, {"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "557707906dd3e34b8a8c265f664d19f95799937e", "status": "affected", "versionType": "git"}, {"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1", "status": "affected", "versionType": "git"}, {"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "3595599fa8360bb3c7afa7ee50c810b4a64106ea", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/dev.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.76"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.13.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b1bc4a35a04cbeb85b6ef5911ec015baa424989f"}, {"url": "https://git.kernel.org/stable/c/557707906dd3e34b8a8c265f664d19f95799937e"}, {"url": "https://git.kernel.org/stable/c/5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1"}, {"url": "https://git.kernel.org/stable/c/3595599fa8360bb3c7afa7ee50c810b4a64106ea"}], "title": "net: xdp: Disallow attaching device-bound programs in generic mode", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21808", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:57.902400Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:53.117Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21808", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:57.902400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:42:58.699Z"}}], "cna": {"title": "net: xdp: Disallow attaching device-bound programs in generic mode", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local syscalls \u2014 bpf(BPF_PROG_LOAD) to create the device-bound program and netlink/BPF-link attach with XDP_FLAGS_SKB_MODE \u2014 before any packet can trigger the bad kfunc call. The packet trigger can be self-generated on a locally created veth pair, so no network position is needed.\nAC:L - The sequence is fully deterministic and attacker-controlled: create a veth pair, load a dev-bound XDP program calling bpf_xdp_metadata_rx_hash(), attach it in generic mode, then send one frame. No race, no special hardware, and the attacker can groom the kernel stack to control the value the driver callback consumes.\nPR:L - The attach side needs only CAP_NET_ADMIN in the target netns, which any unprivileged user obtains via `unshare -Urn`, and BPF program loading is reachable at low privilege in the delegated-BPF-token container deployments this feature targets. Consistent with kernel.org CNA scoring of other BPF program-loading vulnerabilities.\nUI:N - The attacker performs every step \u2014 program load, generic-mode attach, and packet injection \u2014 with no action by any other user or administrator.\nS:U - The wild-pointer read and write occur in kernel memory within the same security authority; there is no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The driver kfuncs dereference an uninitialized stack value as a driver-context pointer and return the loaded kernel memory (mlx5 CQE timestamp, ice RSS hash, veth skb_hwtstamps) into the BPF program, which exports it to userspace \u2014 a kernel-memory read primitive plus stack-content and KASLR disclosure.\nI:H - veth_xdp_rx_hash() reaches __skb_set_sw_hash() and stores through the bogus skb pointer, giving a write at an attacker-influenceable kernel address; combined with the read primitive this is exploitable memory corruption.\nA:H - Dereferencing a stale stack value as a driver descriptor/skb pointer in softirq (NAPI) context reliably oopses or panics the kernel, and the commit message explicitly states the invalid kfunc context leads to crashes."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "b1bc4a35a04cbeb85b6ef5911ec015baa424989f", "versionType": "git"}, {"status": "affected", "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "557707906dd3e34b8a8c265f664d19f95799937e", "versionType": "git"}, {"status": "affected", "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1", "versionType": "git"}, {"status": "affected", "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "lessThan": "3595599fa8360bb3c7afa7ee50c810b4a64106ea", "versionType": "git"}], "programFiles": ["net/core/dev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"status": "unaffected", "version": "0", "lessThan": "6.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.76", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.13", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.2", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/dev.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b1bc4a35a04cbeb85b6ef5911ec015baa424989f"}, {"url": "https://git.kernel.org/stable/c/557707906dd3e34b8a8c265f664d19f95799937e"}, {"url": "https://git.kernel.org/stable/c/5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1"}, {"url": "https://git.kernel.org/stable/c/3595599fa8360bb3c7afa7ee50c810b4a64106ea"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xdp: Disallow attaching device-bound programs in generic mode\n\nDevice-bound programs are used to support RX metadata kfuncs. These\nkfuncs are driver-specific and rely on the driver context to read the\nmetadata. This means they can't work in generic XDP mode. However, there\nis no check to disallow such programs from being attached in generic\nmode, in which case the metadata kfuncs will be called in an invalid\ncontext, leading to crashes.\n\nFix this by adding a check to disallow attaching device-bound programs\nin generic mode."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.76", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.13", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.2", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "6.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:35.691Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21808", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:53.117Z", "dateReserved": "2024-12-29T08:45:45.772Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-02-27T20:01:00.328Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b1bc4a35a04cbeb85b6ef5911ec015baa424989f", "status": "affected", "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "versionType": "git"}, {"lessThan": "557707906dd3e34b8a8c265f664d19f95799937e", "status": "affected", "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "versionType": "git"}, {"lessThan": "5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1", "status": "affected", "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "versionType": "git"}, {"lessThan": "3595599fa8360bb3c7afa7ee50c810b4a64106ea", "status": "affected", "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/dev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.76", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.13", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "743AF020-5140-4702-8AF3-B688405596B9", "versionEndExcluding": "6.6.76", "versionStartIncluding": "6.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2897389C-A8C3-4D69-90F2-E701B3D66373", "versionEndExcluding": "6.12.13", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D4116B1-1BFD-4F23-BA84-169CC05FC5A3", "versionEndExcluding": "6.13.2", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xdp: Disallow attaching device-bound programs in generic mode\n\nDevice-bound programs are used to support RX metadata kfuncs. These\nkfuncs are driver-specific and rely on the driver context to read the\nmetadata. This means they can't work in generic XDP mode. However, there\nis no check to disallow such programs from being attached in generic\nmode, in which case the metadata kfuncs will be called in an invalid\ncontext, leading to crashes.\n\nFix this by adding a check to disallow attaching device-bound programs\nin generic mode."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: xdp: No permitir adjuntar programas vinculados al dispositivo en modo gen\u00e9rico Los programas vinculados al dispositivo se utilizan para admitir las kfuncs de metadatos RX. Estas kfuncs son espec\u00edficas del controlador y dependen del contexto del controlador para leer los metadatos. Esto significa que no pueden funcionar en modo XDP gen\u00e9rico. Sin embargo, no hay ninguna verificaci\u00f3n para no permitir que dichos programas se adjunten en modo gen\u00e9rico, en cuyo caso las kfuncs de metadatos se llamar\u00e1n en un contexto no v\u00e1lido, lo que provocar\u00e1 fallas. Solucione esto agregando una verificaci\u00f3n para no permitir adjuntar programas vinculados al dispositivo en modo gen\u00e9rico."}], "id": "CVE-2025-21808", "lastModified": "2026-10-15T22:18:08.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21808", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:42:57.902400Z", "version": "2.0.3"}}]}, "published": "2025-02-27T20:16:03.410", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3595599fa8360bb3c7afa7ee50c810b4a64106ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/557707906dd3e34b8a8c265f664d19f95799937e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a9eae683d6c36e8a7aa31e5eb8b369e41aa66e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b1bc4a35a04cbeb85b6ef5911ec015baa424989f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: xdp: Disallow attaching device-bound programs in generic mode", "id": "2348898", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348898"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: xdp: Disallow attaching device-bound programs in generic mode\nDevice-bound programs are used to support RX metadata kfuncs. These\nkfuncs are driver-specific and rely on the driver context to read the\nmetadata. This means they can't work in generic XDP mode. However, there\nis no check to disallow such programs from being attached in generic\nmode, in which case the metadata kfuncs will be called in an invalid\ncontext, leading to crashes.\nFix this by adding a check to disallow attaching device-bound programs\nin generic mode."], "name": "CVE-2025-21808", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21808\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21808\nhttps://lore.kernel.org/linux-cve-announce/2025022753-CVE-2025-21808-b8bf@gregkh/T"], "threat_severity": "Low"}

{}