CVE-2025-21799 – A Linux kernel vulnerability in the TI AM65x CP... (How to Fix)

Q: What is the severity of CVE-2025-21799?

CVE-2025-21799 has a CVSS score of 5.5 (MEDIUM). A Linux kernel vulnerability in the TI AM65x CPSW Ethernet driver allows improper IRQ handling when changing network channel configurations. This can cause kernel warnings and potential system instability when users modify network channel settings. Systems using affected Linux kernel versions with the TI AM65x CPSW Ethernet driver are vulnerable.

📋 TL;DR

A Linux kernel vulnerability in the TI AM65x CPSW Ethernet driver allows improper IRQ handling when changing network channel configurations. This can cause kernel warnings and potential system instability when users modify network channel settings. Systems using affected Linux kernel versions with the TI AM65x CPSW Ethernet driver are vulnerable.

💻 Affected Systems

Products:

Linux kernel with TI AM65x CPSW Ethernet driver

Versions: Linux kernel versions containing the vulnerable driver code prior to fixes in stable commits listed in references

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using TI AM65x CPSW Ethernet hardware and when users modify network channel configurations.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash leading to denial of service, potentially disrupting network connectivity and system availability.

🟠

Likely Case

Kernel warning messages and system instability when users attempt to modify network channel configurations via .set_channels.

🟢

If Mitigated

Minor system logs showing kernel warnings without significant operational impact.

🌐 Internet-Facing: LOW - Requires local access or privileged user interaction to trigger the vulnerability.

🏢 Internal Only: MEDIUM - Internal users with network configuration privileges could trigger the issue, potentially affecting system stability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires privileged access to trigger via .set_channels interface. Not easily weaponized for remote exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions with fixes from stable commits: 321990fdf4f1, 4395a44acb15, 8448c87b3af6, 88fd5db8c007, 8aae91ae1c65

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load patched kernel. 3. Verify driver functionality after reboot.

🔧 Temporary Workarounds

Restrict network channel configuration

linux

Prevent users from modifying network channel configurations via .set_channels interface

echo 0 > /sys/class/net/<interface>/channels/tx_max
chmod 400 /sys/class/net/<interface>/channels/*

🧯 If You Can't Patch

Restrict user access to network configuration tools and sysfs interfaces
Monitor system logs for kernel warnings related to IRQ handling or CPSW driver

🔍 How to Verify

Check if Vulnerable:

Check if system uses TI AM65x CPSW Ethernet driver: 'lsmod | grep am65_cpsw' and check kernel version against affected versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits: 'uname -r' and check git log for fix commits

📡 Detection & Monitoring

Log Indicators:

Kernel warnings about invalid IRQ freeing
CPSW driver error messages
System instability after network configuration changes

Network Indicators:

Network interface errors after channel configuration changes

SIEM Query:

source="kernel" AND ("am65_cpsw" OR "IRQ" AND "invalid" OR "freeing")

📊 Metadata

CVE ID: CVE-2025-21799

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.05% exploit probability (16.4th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21799, you might also want to check these: