Use-After-Free Vulnerability in IBM Virtual Network Interface Driver

CVE-2025-21855

Summary

A vulnerability exists in the IBM Virtual Network Interface Driver (IBMVNIC) due to improper handling of socket buffers (SKBs) after transmission to the Virtual I/O Server (VIOS). When an SKB is sent, the driver incorrectly allows further access to the SKB memory. The VIOS can subsequently free this memory, leading to a potential race condition between reading the length of the SKB and the freeing operation, resulting in a use-after-free scenario. This can lead to unpredictable behavior and can compromise system integrity, especially during low-path management operations.

References