CVE-2025-22061 (GCVE-0-2025-22061)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:12 – Updated: 2026-08-05 11:56
VLAI
Title
net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue() Fix the following kernel warning deleting HTB offloaded leafs and/or root HTB qdisc in airoha_eth driver properly reporting qid in airoha_tc_get_htb_get_leaf_queue routine. $tc qdisc replace dev eth1 root handle 10: htb offload $tc class add dev eth1 arent 10: classid 10:4 htb rate 100mbit ceil 100mbit $tc qdisc replace dev eth1 parent 10:4 handle 4: ets bands 8 \ quanta 1514 3028 4542 6056 7570 9084 10598 12112 $tc qdisc del dev eth1 root [ 55.827864] ------------[ cut here ]------------ [ 55.832493] WARNING: CPU: 3 PID: 2678 at 0xffffffc0798695a4 [ 55.956510] CPU: 3 PID: 2678 Comm: tc Tainted: G O 6.6.71 #0 [ 55.963557] Hardware name: Airoha AN7581 Evaluation Board (DT) [ 55.969383] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 55.976344] pc : 0xffffffc0798695a4 [ 55.979851] lr : 0xffffffc079869a20 [ 55.983358] sp : ffffffc0850536a0 [ 55.986665] x29: ffffffc0850536a0 x28: 0000000000000024 x27: 0000000000000001 [ 55.993800] x26: 0000000000000000 x25: ffffff8008b19000 x24: ffffff800222e800 [ 56.000935] x23: 0000000000000001 x22: 0000000000000000 x21: ffffff8008b19000 [ 56.008071] x20: ffffff8002225800 x19: ffffff800379d000 x18: 0000000000000000 [ 56.015206] x17: ffffffbf9ea59000 x16: ffffffc080018000 x15: 0000000000000000 [ 56.022342] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000001 [ 56.029478] x11: ffffffc081471008 x10: ffffffc081575a98 x9 : 0000000000000000 [ 56.036614] x8 : ffffffc08167fd40 x7 : ffffffc08069e104 x6 : ffffff8007f86000 [ 56.043748] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000001 [ 56.050884] x2 : 0000000000000000 x1 : 0000000000000250 x0 : ffffff800222c000 [ 56.058020] Call trace: [ 56.060459] 0xffffffc0798695a4 [ 56.063618] 0xffffffc079869a20 [ 56.066777] __qdisc_destroy+0x40/0xa0 [ 56.070528] qdisc_put+0x54/0x6c [ 56.073748] qdisc_graft+0x41c/0x648 [ 56.077324] tc_get_qdisc+0x168/0x2f8 [ 56.080978] rtnetlink_rcv_msg+0x230/0x330 [ 56.085076] netlink_rcv_skb+0x5c/0x128 [ 56.088913] rtnetlink_rcv+0x14/0x1c [ 56.092490] netlink_unicast+0x1e0/0x2c8 [ 56.096413] netlink_sendmsg+0x198/0x3c8 [ 56.100337] ____sys_sendmsg+0x1c4/0x274 [ 56.104261] ___sys_sendmsg+0x7c/0xc0 [ 56.107924] __sys_sendmsg+0x44/0x98 [ 56.111492] __arm64_sys_sendmsg+0x20/0x28 [ 56.115580] invoke_syscall.constprop.0+0x58/0xfc [ 56.120285] do_el0_svc+0x3c/0xbc [ 56.123592] el0_svc+0x18/0x4c [ 56.126647] el0t_64_sync_handler+0x118/0x124 [ 56.131005] el0t_64_sync+0x150/0x154 [ 56.134660] ---[ end trace 0000000000000000 ]---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ef1ca9271313b4ea7b03de69576aacef1e78f381 , < d7f76197e49e46a8c082a6fededaa8a07e69a860 (git)
Affected: ef1ca9271313b4ea7b03de69576aacef1e78f381 , < 57b290d97c6150774bf929117ca737a26d8fc33d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/airoha/airoha_eth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d7f76197e49e46a8c082a6fededaa8a07e69a860",
              "status": "affected",
              "version": "ef1ca9271313b4ea7b03de69576aacef1e78f381",
              "versionType": "git"
            },
            {
              "lessThan": "57b290d97c6150774bf929117ca737a26d8fc33d",
              "status": "affected",
              "version": "ef1ca9271313b4ea7b03de69576aacef1e78f381",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/airoha/airoha_eth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue()\n\nFix the following kernel warning deleting HTB offloaded leafs and/or root\nHTB qdisc in airoha_eth driver properly reporting qid in\nairoha_tc_get_htb_get_leaf_queue routine.\n\n$tc qdisc replace dev eth1 root handle 10: htb offload\n$tc class add dev eth1 arent 10: classid 10:4 htb rate 100mbit ceil 100mbit\n$tc qdisc replace dev eth1 parent 10:4 handle 4: ets bands 8 \\\n quanta 1514 3028 4542 6056 7570 9084 10598 12112\n$tc qdisc del dev eth1 root\n\n[   55.827864] ------------[ cut here ]------------\n[   55.832493] WARNING: CPU: 3 PID: 2678 at 0xffffffc0798695a4\n[   55.956510] CPU: 3 PID: 2678 Comm: tc Tainted: G           O 6.6.71 #0\n[   55.963557] Hardware name: Airoha AN7581 Evaluation Board (DT)\n[   55.969383] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   55.976344] pc : 0xffffffc0798695a4\n[   55.979851] lr : 0xffffffc079869a20\n[   55.983358] sp : ffffffc0850536a0\n[   55.986665] x29: ffffffc0850536a0 x28: 0000000000000024 x27: 0000000000000001\n[   55.993800] x26: 0000000000000000 x25: ffffff8008b19000 x24: ffffff800222e800\n[   56.000935] x23: 0000000000000001 x22: 0000000000000000 x21: ffffff8008b19000\n[   56.008071] x20: ffffff8002225800 x19: ffffff800379d000 x18: 0000000000000000\n[   56.015206] x17: ffffffbf9ea59000 x16: ffffffc080018000 x15: 0000000000000000\n[   56.022342] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000001\n[   56.029478] x11: ffffffc081471008 x10: ffffffc081575a98 x9 : 0000000000000000\n[   56.036614] x8 : ffffffc08167fd40 x7 : ffffffc08069e104 x6 : ffffff8007f86000\n[   56.043748] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000001\n[   56.050884] x2 : 0000000000000000 x1 : 0000000000000250 x0 : ffffff800222c000\n[   56.058020] Call trace:\n[   56.060459]  0xffffffc0798695a4\n[   56.063618]  0xffffffc079869a20\n[   56.066777]  __qdisc_destroy+0x40/0xa0\n[   56.070528]  qdisc_put+0x54/0x6c\n[   56.073748]  qdisc_graft+0x41c/0x648\n[   56.077324]  tc_get_qdisc+0x168/0x2f8\n[   56.080978]  rtnetlink_rcv_msg+0x230/0x330\n[   56.085076]  netlink_rcv_skb+0x5c/0x128\n[   56.088913]  rtnetlink_rcv+0x14/0x1c\n[   56.092490]  netlink_unicast+0x1e0/0x2c8\n[   56.096413]  netlink_sendmsg+0x198/0x3c8\n[   56.100337]  ____sys_sendmsg+0x1c4/0x274\n[   56.104261]  ___sys_sendmsg+0x7c/0xc0\n[   56.107924]  __sys_sendmsg+0x44/0x98\n[   56.111492]  __arm64_sys_sendmsg+0x20/0x28\n[   56.115580]  invoke_syscall.constprop.0+0x58/0xfc\n[   56.120285]  do_el0_svc+0x3c/0xbc\n[   56.123592]  el0_svc+0x18/0x4c\n[   56.126647]  el0t_64_sync_handler+0x118/0x124\n[   56.131005]  el0t_64_sync+0x150/0x154\n[   56.134660] ---[ end trace 0000000000000000 ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through an `AF_NETLINK`/`NETLINK_ROUTE` socket (`RTM_NEWQDISC`/`RTM_DELQDISC` via `tc`), which requires local system access. No remote peer data reaches `airoha_tc_get_htb_get_leaf_queue()`.\nAC:L - The wrong qid is returned deterministically for every `TC_HTB_LEAF_QUERY_QUEUE`, and the four-command reproducer in the commit triggers the WARN 100% of the time; the follow-on lock-exclusion race has both sides under attacker control (they issue `tc qdisc change` while generating traffic on the offloaded channel).\nPR:L - `rtnetlink_rcv_msg()` gates on namespace-relative `CAP_NET_ADMIN` (`netlink_net_capable`), which an unprivileged user obtains via `unshare -Urn`; per kernel scoring practice tc/qdisc netlink paths are Low, not High.\nUI:N - The attacker performs the entire sequence (create offloaded HTB root, add class, graft a child qdisc, tear it down) from their own process. No victim action is involved.\nS:U - The corruption and the resulting crash stay within the kernel\u0027s own security authority on the affected host; no VM, sandbox, or IOMMU boundary is crossed.\nC:H - The mismatched `sch-\u003edev_queue` makes `sch_tree_lock()` acquire an unrelated qdisc\u0027s lock, so `ets_qdisc_change()` mutates `q-\u003eactive`/`q-\u003eclasses[].alist` and swaps child qdisc pointers concurrently with `ets_qdisc_dequeue()`, yielding a use-after-free on freed qdisc objects that can be leveraged as a kernel-memory read primitive.\nI:H - The same loss of mutual exclusion permits unsynchronized `list_del`/`list_move_tail` on the ETS active list and `qdisc_put()` of a qdisc the datapath is still dereferencing, giving linked-list corruption and a UAF write primitive suitable for control-flow hijacking.\nA:H - The commit documents a reproducible `WARN_ON` splat on `tc qdisc del dev eth1 root`, which is a kernel panic on the `panic_on_warn` configurations common to hardened and embedded builds, and the resulting corrupted qdisc/TX-queue state additionally causes oopses via the racing ETS teardown."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:27.146Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d7f76197e49e46a8c082a6fededaa8a07e69a860"
        },
        {
          "url": "https://git.kernel.org/stable/c/57b290d97c6150774bf929117ca737a26d8fc33d"
        }
      ],
      "title": "net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22061",
    "datePublished": "2025-04-16T14:12:16.924Z",
    "dateReserved": "2024-12-29T08:45:45.812Z",
    "dateUpdated": "2026-08-05T11:56:27.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22061",
      "date": "2026-09-27",
      "epss": "0.00231",
      "percentile": "0.12611"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/airoha/airoha_eth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d7f76197e49e46a8c082a6fededaa8a07e69a860",
                    "status": "affected",
                    "version": "ef1ca9271313b4ea7b03de69576aacef1e78f381",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "57b290d97c6150774bf929117ca737a26d8fc33d",
                    "status": "affected",
                    "version": "ef1ca9271313b4ea7b03de69576aacef1e78f381",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/airoha/airoha_eth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FADAE5D8-4808-442C-B218-77B2CE8780A0",
                    "versionEndExcluding": "6.14.2",
                    "versionStartIncluding": "6.14",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue()\n\nFix the following kernel warning deleting HTB offloaded leafs and/or root\nHTB qdisc in airoha_eth driver properly reporting qid in\nairoha_tc_get_htb_get_leaf_queue routine.\n\n$tc qdisc replace dev eth1 root handle 10: htb offload\n$tc class add dev eth1 arent 10: classid 10:4 htb rate 100mbit ceil 100mbit\n$tc qdisc replace dev eth1 parent 10:4 handle 4: ets bands 8 \\\n quanta 1514 3028 4542 6056 7570 9084 10598 12112\n$tc qdisc del dev eth1 root\n\n[   55.827864] ------------[ cut here ]------------\n[   55.832493] WARNING: CPU: 3 PID: 2678 at 0xffffffc0798695a4\n[   55.956510] CPU: 3 PID: 2678 Comm: tc Tainted: G           O 6.6.71 #0\n[   55.963557] Hardware name: Airoha AN7581 Evaluation Board (DT)\n[   55.969383] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   55.976344] pc : 0xffffffc0798695a4\n[   55.979851] lr : 0xffffffc079869a20\n[   55.983358] sp : ffffffc0850536a0\n[   55.986665] x29: ffffffc0850536a0 x28: 0000000000000024 x27: 0000000000000001\n[   55.993800] x26: 0000000000000000 x25: ffffff8008b19000 x24: ffffff800222e800\n[   56.000935] x23: 0000000000000001 x22: 0000000000000000 x21: ffffff8008b19000\n[   56.008071] x20: ffffff8002225800 x19: ffffff800379d000 x18: 0000000000000000\n[   56.015206] x17: ffffffbf9ea59000 x16: ffffffc080018000 x15: 0000000000000000\n[   56.022342] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000001\n[   56.029478] x11: ffffffc081471008 x10: ffffffc081575a98 x9 : 0000000000000000\n[   56.036614] x8 : ffffffc08167fd40 x7 : ffffffc08069e104 x6 : ffffff8007f86000\n[   56.043748] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000001\n[   56.050884] x2 : 0000000000000000 x1 : 0000000000000250 x0 : ffffff800222c000\n[   56.058020] Call trace:\n[   56.060459]  0xffffffc0798695a4\n[   56.063618]  0xffffffc079869a20\n[   56.066777]  __qdisc_destroy+0x40/0xa0\n[   56.070528]  qdisc_put+0x54/0x6c\n[   56.073748]  qdisc_graft+0x41c/0x648\n[   56.077324]  tc_get_qdisc+0x168/0x2f8\n[   56.080978]  rtnetlink_rcv_msg+0x230/0x330\n[   56.085076]  netlink_rcv_skb+0x5c/0x128\n[   56.088913]  rtnetlink_rcv+0x14/0x1c\n[   56.092490]  netlink_unicast+0x1e0/0x2c8\n[   56.096413]  netlink_sendmsg+0x198/0x3c8\n[   56.100337]  ____sys_sendmsg+0x1c4/0x274\n[   56.104261]  ___sys_sendmsg+0x7c/0xc0\n[   56.107924]  __sys_sendmsg+0x44/0x98\n[   56.111492]  __arm64_sys_sendmsg+0x20/0x28\n[   56.115580]  invoke_syscall.constprop.0+0x58/0xfc\n[   56.120285]  do_el0_svc+0x3c/0xbc\n[   56.123592]  el0_svc+0x18/0x4c\n[   56.126647]  el0t_64_sync_handler+0x118/0x124\n[   56.131005]  el0t_64_sync+0x150/0x154\n[   56.134660] ---[ end trace 0000000000000000 ]---"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: airoha: Se corrige el informe qid en airoha_tc_get_htb_get_leaf_queue() Se corrige la siguiente advertencia del kernel que elimina las hojas descargadas de HTB y/o el qdisc de HTB ra\u00edz en el controlador airoha_eth que informa correctamente el qid en la rutina airoha_tc_get_htb_get_leaf_queue. $tc qdisc replace dev eth1 root handle 10: htb offload $tc class add dev eth1 arent 10: classid 10:4 htb rate 100mbit ceil 100mbit $tc qdisc replace dev eth1 parent 10:4 handle 4: ets bands 8 \\ quanta 1514 3028 4542 6056 7570 9084 10598 12112 $tc qdisc del dev eth1 root [ 55.827864] ------------[ cortar aqu\u00ed ]------------ [ 55.832493] ADVERTENCIA: CPU: 3 PID: 2678 en 0xffffffc0798695a4 [ 55.956510] CPU: 3 PID: 2678 Comm: tc Tainted: GO 6.6.71 #0 [ 55.963557] Nombre del hardware: Placa de evaluaci\u00f3n Airoha AN7581 (DT) [ 55.969383] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 55.976344] pc : 0xffffffc0798695a4 [ 55.979851] lr : 0xffffffc079869a20 [ 55.983358] sp : ffffffc0850536a0 [ 55.986665] x29: ffffffc0850536a0 x28: 0000000000000024 x27: 0000000000000001 [ 55.993800] x26: 0000000000000000 x25: ffffff8008b19000 x24: ffffff800222e800 [ 56.000935] x23: 000000000000001 x22: 0000000000000000 x21: ffffff8008b19000 [ 56.008071] x20: ffffff8002225800 x19: ffffff800379d000 x18: 000000000000000 [ 56.015206] x17: ffffffbf9ea59000 x16: ffffffc080018000 x15: 0000000000000000 [ 56.022342] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000001 [ 56.029478] x11: fffffc081471008 x10: fffffc081575a98 x9: 0000000000000000 [ 56.036614] x8: fffffc08167fd40 x7: fffffc08069e104 x6 : ffffff8007f86000 [ 56.043748] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000001 [ 56.050884] x2 : 0000000000000000 x1 : 0000000000000250 x0 : ffffff800222c000 [ 56.058020] Rastreo de llamadas: [ 56.060459] 0xffffffc0798695a4 [ 56.063618] 0xffffffc079869a20 [ 56.066777] __qdisc_destroy+0x40/0xa0 [ 56.070528] qdisc_put+0x54/0x6c [ 56.073748] qdisc_graft+0x41c/0x648 [ 56.077324] tc_get_qdisc+0x168/0x2f8 [ 56.080978] rtnetlink_rcv_msg+0x230/0x330 [ 56.085076] netlink_rcv_skb+0x5c/0x128 [ 56.088913] rtnetlink_rcv+0x14/0x1c [ 56.092490] netlink_unicast+0x1e0/0x2c8 [ 56.096413] netlink_sendmsg+0x198/0x3c8 [ 56.100337] ____sys_sendmsg+0x1c4/0x274 [ 56.104261] ___sys_sendmsg+0x7c/0xc0 [ 56.107924] __sys_sendmsg+0x44/0x98 [ 56.111492] __arm64_sys_sendmsg+0x20/0x28 [ 56.115580] invocar_syscall.constprop.0+0x58/0xfc [ 56.120285] do_el0_svc+0x3c/0xbc [ 56.123592] el0_svc+0x18/0x4c [ 56.126647] el0t_64_sync_handler+0x118/0x124 [ 56.131005] el0t_64_sync+0x150/0x154 [ 56.134660] ---[ fin de seguimiento 0000000000000000 ]---"
          }
        ],
        "id": "CVE-2025-22061",
        "lastModified": "2026-07-30T06:22:09.897",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-04-16T15:15:59.580",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/57b290d97c6150774bf929117ca737a26d8fc33d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d7f76197e49e46a8c082a6fededaa8a07e69a860"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:24:13+00:00",
      "cve": "CVE-2025-22061",
      "id": "CVE-2025-22061",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22061.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:25:14Z",
      "cve": "CVE-2025-22061",
      "id": "CVE-2025-22061",
      "initial_release_date": "2025-04-18T23:20:09Z",
      "product_status:known_not_affected": "459",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-22061",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-22061.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.