{"api_version":"1","generated_at":"2026-11-14T00:02:43+00:00","cve":"CVE-2025-21681","urls":{"html":"https://cve.report/CVE-2025-21681","api":"https://cve.report/api/cve/CVE-2025-21681.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-21681","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-21681"},"summary":{"title":"openvswitch: fix lockup on tx to unregistering netdev with carrier","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix lockup on tx to unregistering netdev with carrier\n\nCommit in a fixes tag attempted to fix the issue in the following\nsequence of calls:\n\n    do_output\n    -> ovs_vport_send\n       -> dev_queue_xmit\n          -> __dev_queue_xmit\n             -> netdev_core_pick_tx\n                -> skb_tx_hash\n\nWhen device is unregistering, the 'dev->real_num_tx_queues' goes to\nzero and the 'while (unlikely(hash >= qcount))' loop inside the\n'skb_tx_hash' becomes infinite, locking up the core forever.\n\nBut unfortunately, checking just the carrier status is not enough to\nfix the issue, because some devices may still be in unregistering\nstate while reporting carrier status OK.\n\nOne example of such device is a net/dummy.  It sets carrier ON\non start, but it doesn't implement .ndo_stop to set the carrier off.\nAnd it makes sense, because dummy doesn't really have a carrier.\nTherefore, while this device is unregistering, it's still easy to hit\nthe infinite loop in the skb_tx_hash() from the OVS datapath.  There\nmight be other drivers that do the same, but dummy by itself is\nimportant for the OVS ecosystem, because it is frequently used as a\npacket sink for tcpdump while debugging OVS deployments.  And when the\nissue is hit, the only way to recover is to reboot.\n\nFix that by also checking if the device is running.  The running\nstate is handled by the net core during unregistering, so it covers\nunregistering case better, and we don't really need to send packets\nto devices that are not running anyway.\n\nWhile only checking the running state might be enough, the carrier\ncheck is preserved.  The running and the carrier states seem disjoined\nthroughout the code and different drivers.  And other core functions\nlike __dev_direct_xmit() check both before attempting to transmit\na packet.  So, it seems safer to check both flags in OVS as well.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-01-31 12:15:29","updated_at":"2026-11-05 21:17:41"},"problem_types":["CWE-835"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/82f433e8dd0629e16681edf6039d094b5518d8ed","name":"https://git.kernel.org/stable/c/82f433e8dd0629e16681edf6039d094b5518d8ed","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092","name":"https://git.kernel.org/stable/c/b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ea966b6698785fb9cd0fdb867acd91b222e4723f","name":"https://git.kernel.org/stable/c/ea966b6698785fb9cd0fdb867acd91b222e4723f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ea9e990356b7bee95440ba0e6e83cc4d701afaca","name":"https://git.kernel.org/stable/c/ea9e990356b7bee95440ba0e6e83cc4d701afaca","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/930268823f6bccb697aa5d2047aeffd4a497308c","name":"https://git.kernel.org/stable/c/930268823f6bccb697aa5d2047aeffd4a497308c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/87fcf0d137c770e6040ebfdb0abd8e7dd481b504","name":"https://git.kernel.org/stable/c/87fcf0d137c770e6040ebfdb0abd8e7dd481b504","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/47e55e4b410f7d552e43011baa5be1aab4093990","name":"https://git.kernel.org/stable/c/47e55e4b410f7d552e43011baa5be1aab4093990","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","name":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21681","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21681","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9b0dd09c1ceb35950d2884848099fccc9ec9a123 b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 284be5db6c8d06d247ed056cfc448c4f79bbb16c 87fcf0d137c770e6040ebfdb0abd8e7dd481b504 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5efcb301523baacd98a47553d4996e924923114d 930268823f6bccb697aa5d2047aeffd4a497308c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 644b3051b06ba465bc7401bfae9b14963cbc8c1c ea9e990356b7bee95440ba0e6e83cc4d701afaca git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8 ea966b6698785fb9cd0fdb867acd91b222e4723f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8 82f433e8dd0629e16681edf6039d094b5518d8ed git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8 47e55e4b410f7d552e43011baa5be1aab4093990 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 56252da41426f3d01957456f13caf46ce670ea29 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.25 6.1.127 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.2.12 6.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.3","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.127 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.74 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.11 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.13 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"21681","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2025-11-03T20:58:58.631Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2025-21681","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:34:18.310573Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-05T20:41:40.561Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/openvswitch/actions.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092","status":"affected","version":"9b0dd09c1ceb35950d2884848099fccc9ec9a123","versionType":"git"},{"lessThan":"87fcf0d137c770e6040ebfdb0abd8e7dd481b504","status":"affected","version":"284be5db6c8d06d247ed056cfc448c4f79bbb16c","versionType":"git"},{"lessThan":"930268823f6bccb697aa5d2047aeffd4a497308c","status":"affected","version":"5efcb301523baacd98a47553d4996e924923114d","versionType":"git"},{"lessThan":"ea9e990356b7bee95440ba0e6e83cc4d701afaca","status":"affected","version":"644b3051b06ba465bc7401bfae9b14963cbc8c1c","versionType":"git"},{"lessThan":"ea966b6698785fb9cd0fdb867acd91b222e4723f","status":"affected","version":"066b86787fa3d97b7aefb5ac0a99a22dad2d15f8","versionType":"git"},{"lessThan":"82f433e8dd0629e16681edf6039d094b5518d8ed","status":"affected","version":"066b86787fa3d97b7aefb5ac0a99a22dad2d15f8","versionType":"git"},{"lessThan":"47e55e4b410f7d552e43011baa5be1aab4093990","status":"affected","version":"066b86787fa3d97b7aefb5ac0a99a22dad2d15f8","versionType":"git"},{"status":"affected","version":"56252da41426f3d01957456f13caf46ce670ea29","versionType":"git"},{"lessThan":"6.1.127","status":"affected","version":"6.1.25","versionType":"semver"},{"lessThan":"6.3","status":"affected","version":"6.2.12","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/openvswitch/actions.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.3"},{"lessThan":"6.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.127","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.74","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.13","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.127","versionStartIncluding":"6.1.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.74","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.11","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix lockup on tx to unregistering netdev with carrier\n\nCommit in a fixes tag attempted to fix the issue in the following\nsequence of calls:\n\n    do_output\n    -> ovs_vport_send\n       -> dev_queue_xmit\n          -> __dev_queue_xmit\n             -> netdev_core_pick_tx\n                -> skb_tx_hash\n\nWhen device is unregistering, the 'dev->real_num_tx_queues' goes to\nzero and the 'while (unlikely(hash >= qcount))' loop inside the\n'skb_tx_hash' becomes infinite, locking up the core forever.\n\nBut unfortunately, checking just the carrier status is not enough to\nfix the issue, because some devices may still be in unregistering\nstate while reporting carrier status OK.\n\nOne example of such device is a net/dummy.  It sets carrier ON\non start, but it doesn't implement .ndo_stop to set the carrier off.\nAnd it makes sense, because dummy doesn't really have a carrier.\nTherefore, while this device is unregistering, it's still easy to hit\nthe infinite loop in the skb_tx_hash() from the OVS datapath.  There\nmight be other drivers that do the same, but dummy by itself is\nimportant for the OVS ecosystem, because it is frequently used as a\npacket sink for tcpdump while debugging OVS deployments.  And when the\nissue is hit, the only way to recover is to reboot.\n\nFix that by also checking if the device is running.  The running\nstate is handled by the net core during unregistering, so it covers\nunregistering case better, and we don't really need to send packets\nto devices that are not running anyway.\n\nWhile only checking the running state might be enough, the carrier\ncheck is preserved.  The running and the carrier states seem disjoined\nthroughout the code and different drivers.  And other core functions\nlike __dev_direct_xmit() check both before attempting to transmit\na packet.  So, it seems safer to check both flags in OVS as well."}],"providerMetadata":{"dateUpdated":"2026-05-23T15:56:52.799Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092"},{"url":"https://git.kernel.org/stable/c/87fcf0d137c770e6040ebfdb0abd8e7dd481b504"},{"url":"https://git.kernel.org/stable/c/930268823f6bccb697aa5d2047aeffd4a497308c"},{"url":"https://git.kernel.org/stable/c/ea9e990356b7bee95440ba0e6e83cc4d701afaca"},{"url":"https://git.kernel.org/stable/c/ea966b6698785fb9cd0fdb867acd91b222e4723f"},{"url":"https://git.kernel.org/stable/c/82f433e8dd0629e16681edf6039d094b5518d8ed"},{"url":"https://git.kernel.org/stable/c/47e55e4b410f7d552e43011baa5be1aab4093990"}],"title":"openvswitch: fix lockup on tx to unregistering netdev with carrier","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-21681","datePublished":"2025-01-31T11:25:41.491Z","dateReserved":"2024-12-29T08:45:45.739Z","dateUpdated":"2026-11-05T20:41:40.561Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-01-31 12:15:29","lastModifiedDate":"2026-11-05 21:17:41","problem_types":["CWE-835"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-05T20:34:18.310573Z","id":"CVE-2025-21681","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.25","versionEndExcluding":"6.1.127","matchCriteriaId":"D40EAF88-F300-4CBF-8C2F-CD9CCE985D18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.12","versionEndExcluding":"6.6.74","matchCriteriaId":"66EDD4B5-2C3A-4A8E-AE60-49C429BCB3E7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.11","matchCriteriaId":"B7D0DBC3-F63C-4396-8A47-6F3D4FA0556E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*","matchCriteriaId":"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*","matchCriteriaId":"5A073481-106D-4B15-B4C7-FB0213B8E1D4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*","matchCriteriaId":"DE491969-75AE-4A6B-9A58-8FC5AF98798F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*","matchCriteriaId":"93C0660D-7FB8-4FBA-892A-B064BA71E49E"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*","matchCriteriaId":"034C36A6-C481-41F3-AE9A-D116E5BE6895"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*","matchCriteriaId":"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*","matchCriteriaId":"5DFCDFB8-4FD0-465A-9076-D813D78FE51B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"21681","Ordinal":"1","Title":"openvswitch: fix lockup on tx to unregistering netdev with carri","CVE":"CVE-2025-21681","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"21681","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix lockup on tx to unregistering netdev with carrier\n\nCommit in a fixes tag attempted to fix the issue in the following\nsequence of calls:\n\n    do_output\n    -> ovs_vport_send\n       -> dev_queue_xmit\n          -> __dev_queue_xmit\n             -> netdev_core_pick_tx\n                -> skb_tx_hash\n\nWhen device is unregistering, the 'dev->real_num_tx_queues' goes to\nzero and the 'while (unlikely(hash >= qcount))' loop inside the\n'skb_tx_hash' becomes infinite, locking up the core forever.\n\nBut unfortunately, checking just the carrier status is not enough to\nfix the issue, because some devices may still be in unregistering\nstate while reporting carrier status OK.\n\nOne example of such device is a net/dummy.  It sets carrier ON\non start, but it doesn't implement .ndo_stop to set the carrier off.\nAnd it makes sense, because dummy doesn't really have a carrier.\nTherefore, while this device is unregistering, it's still easy to hit\nthe infinite loop in the skb_tx_hash() from the OVS datapath.  There\nmight be other drivers that do the same, but dummy by itself is\nimportant for the OVS ecosystem, because it is frequently used as a\npacket sink for tcpdump while debugging OVS deployments.  And when the\nissue is hit, the only way to recover is to reboot.\n\nFix that by also checking if the device is running.  The running\nstate is handled by the net core during unregistering, so it covers\nunregistering case better, and we don't really need to send packets\nto devices that are not running anyway.\n\nWhile only checking the running state might be enough, the carrier\ncheck is preserved.  The running and the carrier states seem disjoined\nthroughout the code and different drivers.  And other core functions\nlike __dev_direct_xmit() check both before attempting to transmit\na packet.  So, it seems safer to check both flags in OVS as well.","Type":"Description","Title":"openvswitch: fix lockup on tx to unregistering netdev with carri"}]}}}