openvswitch: fix lockup on tx to unregistering netdev with carrier

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2025-21681
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-01-31 12:15:29 UTC
Updated2026-11-05 21:17:41 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: openvswitch: fix lockup on tx to unregistering netdev with carrier Commit in a fixes tag attempted to fix the issue in the following sequence of calls: do_output -> ovs_vport_send -> dev_queue_xmit -> __dev_queue_xmit -> netdev_core_pick_tx -> skb_tx_hash When device is unregistering, the 'dev->real_num_tx_queues' goes to zero and the 'while (unlikely(hash >= qcount))' loop inside the 'skb_tx_hash' becomes infinite, locking up the core forever. But unfortunately, checking just the carrier status is not enough to fix the issue, because some devices may still be in unregistering state while reporting carrier status OK. One example of such device is a net/dummy. It sets carrier ON on start, but it doesn't implement .ndo_stop to set the carrier off. And it makes sense, because dummy doesn't really have a carrier. Therefore, while this device is unregistering, it's still easy to hit the infinite loop in the skb_tx_hash() from the OVS datapath. There might be other drivers that do the same, but dummy by itself is important for the OVS ecosystem, because it is frequently used as a packet sink for tcpdump while debugging OVS deployments. And when the issue is hit, the only way to recover is to reboot. Fix that by also checking if the device is running. The running state is handled by the net core during unregistering, so it covers unregistering case better, and we don't really need to send packets to devices that are not running anyway. While only checking the running state might be enough, the carrier check is preserved. The running and the carrier states seem disjoined throughout the code and different drivers. And other core functions like __dev_direct_xmit() check both before attempting to transmit a packet. So, it seems safer to check both flags in OVS as well.

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-835

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 9b0dd09c1ceb35950d2884848099fccc9ec9a123 b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092 git Not specified
CNA Linux Linux affected 284be5db6c8d06d247ed056cfc448c4f79bbb16c 87fcf0d137c770e6040ebfdb0abd8e7dd481b504 git Not specified
CNA Linux Linux affected 5efcb301523baacd98a47553d4996e924923114d 930268823f6bccb697aa5d2047aeffd4a497308c git Not specified
CNA Linux Linux affected 644b3051b06ba465bc7401bfae9b14963cbc8c1c ea9e990356b7bee95440ba0e6e83cc4d701afaca git Not specified
CNA Linux Linux affected 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8 ea966b6698785fb9cd0fdb867acd91b222e4723f git Not specified
CNA Linux Linux affected 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8 82f433e8dd0629e16681edf6039d094b5518d8ed git Not specified
CNA Linux Linux affected 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8 47e55e4b410f7d552e43011baa5be1aab4093990 git Not specified
CNA Linux Linux affected 56252da41426f3d01957456f13caf46ce670ea29 git Not specified
CNA Linux Linux affected 6.1.25 6.1.127 semver Not specified
CNA Linux Linux affected 6.2.12 6.3 semver Not specified
CNA Linux Linux affected 6.3 Not specified
CNA Linux Linux unaffected 6.3 semver Not specified
CNA Linux Linux unaffected 6.1.127 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.74 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.11 6.12.* semver Not specified
CNA Linux Linux unaffected 6.13 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/82f433e8dd0629e16681edf6039d094b5518d8ed 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ea966b6698785fb9cd0fdb867acd91b222e4723f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/ea9e990356b7bee95440ba0e6e83cc4d701afaca 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/930268823f6bccb697aa5d2047aeffd4a497308c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/87fcf0d137c770e6040ebfdb0abd8e7dd481b504 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/47e55e4b410f7d552e43011baa5be1aab4093990 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/03/msg00001.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report