CVE-2025-21728 – A Linux kernel vulnerability where BPF programs... (How to Fix)

Q: What is the severity of CVE-2025-21728?

CVE-2025-21728 has a CVSS score of 5.5 (MEDIUM). A Linux kernel vulnerability where BPF programs running in non-preemptible contexts can cause system instability when using the bpf_send_signal() kfunc, which may sleep. This affects systems running vulnerable Linux kernel versions with BPF enabled. Attackers could potentially trigger denial of service conditions.

📋 TL;DR

A Linux kernel vulnerability where BPF programs running in non-preemptible contexts can cause system instability when using the bpf_send_signal() kfunc, which may sleep. This affects systems running vulnerable Linux kernel versions with BPF enabled. Attackers could potentially trigger denial of service conditions.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions not explicitly stated; check git commits for affected kernel versions

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires BPF subsystem to be enabled and accessible; typically requires CAP_BPF or CAP_SYS_ADMIN capabilities to exploit.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash leading to complete denial of service, potentially requiring physical access to restore functionality.

🟠

Likely Case

System instability, application crashes, or temporary denial of service affecting specific processes or services.

🟢

If Mitigated

Minimal impact if BPF is disabled or systems are properly patched; isolated process failures at most.

🌐 Internet-Facing: LOW - Requires local access or ability to execute BPF programs, which typically requires elevated privileges.

🏢 Internal Only: MEDIUM - Malicious insiders or compromised accounts with BPF execution privileges could cause system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to load and execute BPF programs, which typically requires elevated privileges. The vulnerability is in kernel code execution path.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific kernel versions from provided git commits

Vendor Advisory: https://git.kernel.org/stable/c/092fc76b7ab4163e008f9cde596a58dad2108260

Restart Required: Yes

Instructions:

1. Identify current kernel version. 2. Apply kernel update from your distribution's repository. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable BPF subsystem

linux

Prevents loading and execution of BPF programs that could trigger the vulnerability

echo 0 > /proc/sys/kernel/unprivileged_bpf_disabled
sysctl -w kernel.unprivileged_bpf_disabled=1

Restrict BPF capabilities

linux

Limit which users can load BPF programs using Linux capabilities

setcap -r /path/to/binary
capsh --drop=cap_bpf -- -c 'command'

🧯 If You Can't Patch

Restrict BPF program loading to trusted users only using Linux capabilities and namespaces.
Implement strict monitoring for BPF program execution and system stability metrics.

🔍 How to Verify

Check if Vulnerable:

Check kernel version against patched versions in git commits: uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update matches patched version and test BPF functionality

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
BPF program loading failures
System instability logs

Network Indicators:

None - this is a local kernel vulnerability

SIEM Query:

source="kernel" AND ("panic" OR "oops" OR "BPF")

📊 Metadata

CVE ID: CVE-2025-21728

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.06% exploit probability (18.6th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON