CVE-2025-22060 – A race condition vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2025-22060?

CVE-2025-22060 has a CVSS score of 4.7 (MEDIUM). A race condition vulnerability in the Linux kernel's Marvell PP2 network driver allows concurrent modifications to parser TCAM/SRAM memory, potentially corrupting network classification rules. This affects systems using the mvpp2 driver on multi-core processors. The vulnerability can cause the classifier to drop legitimate network traffic.

📋 TL;DR

A race condition vulnerability in the Linux kernel's Marvell PP2 network driver allows concurrent modifications to parser TCAM/SRAM memory, potentially corrupting network classification rules. This affects systems using the mvpp2 driver on multi-core processors. The vulnerability can cause the classifier to drop legitimate network traffic.

💻 Affected Systems

Products:

Linux kernel with Marvell PP2 network driver (mvpp2)

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with mvpp2 driver loaded and active, typically on Marvell Armada platforms.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Network traffic disruption causing denial of service for affected network interfaces, potentially impacting critical network services.

🟠

Likely Case

Intermittent network packet drops on interfaces using the mvpp2 driver, leading to degraded network performance.

🟢

If Mitigated

Minimal impact with proper kernel patching and system isolation.

🌐 Internet-Facing: MEDIUM - Could affect network-facing services if vulnerable driver is used on external interfaces.

🏢 Internal Only: MEDIUM - Internal network services could experience packet drops affecting application performance.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM - Requires triggering race condition on multi-core system with mvpp2 driver active.

Exploitation requires local access to trigger concurrent mvpp2_set_rx_mode() calls. No remote exploitation vector identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions containing commits: 46c1e23e34c9d1eaadf37f88216d9d8ce0d0bcee, 5b0ae1723a7d9574ae1aee7d9cf9757a30069865, 96844075226b49af25a69a1d084b648ec2d9b08d, b3f48a41a00d6d8d9c6fe09ae47dd21c8c1c8b03, e3711163d14d02af9005e4cdad30899c565f13fb

Vendor Advisory: https://git.kernel.org/stable/c/46c1e23e34c9d1eaadf37f88216d9d8ce0d0bcee

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify mvpp2 driver is functioning correctly post-update.

🔧 Temporary Workarounds

Disable mvpp2 driver

linux

Remove or blacklist the vulnerable driver if not required

echo 'blacklist mvpp2' >> /etc/modprobe.d/blacklist.conf
rmmod mvpp2

CPU affinity isolation

linux

Isolate mvpp2 driver to specific CPU cores to reduce concurrency

taskset -c 0-1 /path/to/network_service

🧯 If You Can't Patch

Isolate affected systems from critical network paths
Implement network monitoring for rx_classifier_drops counter increases

🔍 How to Verify

Check if Vulnerable:

Check if mvpp2 driver is loaded: lsmod | grep mvpp2 AND check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and monitor rx_classifier_drops counter: ethtool -S <interface> | grep classifier_drops

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing mvpp2 errors
Increased network interface errors in system logs

Network Indicators:

Unexplained unicast packet drops on affected interfaces
Network performance degradation

SIEM Query:

source="kernel" AND ("mvpp2" OR "classifier_drops")

📊 Metadata

CVE ID: CVE-2025-22060

CVSS v3 Score: 4.7 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-367

EPSS Score: 0.1% exploit probability (28.3th percentile)

Published: April 16, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-22060, you might also want to check these: