VLAN Device Misconfiguration in Linux Kernel Affects Networking Functions

CVE-2025-21920

Summary

A vulnerability exists within the Linux kernel related to Virtual Local Area Network (VLAN) device initialization. This flaw allows VLAN devices to be improperly created on non-ethernet devices, leading to the potential leakage of sensitive kernel function addresses to user-mode applications. This occurs during the initialization of GARP and MRP applications for the underlying devices, causing out-of-bounds memory access when device address lengths exceed the expected size. The issue is particularly problematic as it can be exploited via specific command sequences, highlighting the necessity for strict device type enforcement during VLAN device creation to maintain kernel integrity.

References