CVE-2025-22075 – A memory allocation vulnerability in the Linux ... (How to Fix)

Q: What is the severity of CVE-2025-22075?

CVE-2025-22075 has a CVSS score of 5.5 (MEDIUM). A memory allocation vulnerability in the Linux kernel's rtnetlink component causes kernel warnings and 'Message too long' errors when querying network interfaces with many VF GUIDs. This affects systems using SR-IOV with InfiniBand or similar network devices when querying VF information via netlink commands like 'ip link show'. The vulnerability can cause denial of service through kernel warnings and failed network queries.

📋 TL;DR

A memory allocation vulnerability in the Linux kernel's rtnetlink component causes kernel warnings and 'Message too long' errors when querying network interfaces with many VF GUIDs. This affects systems using SR-IOV with InfiniBand or similar network devices when querying VF information via netlink commands like 'ip link show'. The vulnerability can cause denial of service through kernel warnings and failed network queries.

💻 Affected Systems

Products:

Linux kernel

Versions: Linux kernel versions between commit 30aad41721e0 (net/core: Add support for getting VF GUIDs) and the fix commits listed in references

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires SR-IOV configuration with many VFs (Virtual Functions) and InfiniBand or similar devices that support VF GUIDs. Triggered by commands like 'ip link show' on affected interfaces.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash if the memory allocation issue triggers more severe kernel bugs during the warning handling, leading to complete system unavailability.

🟠

Likely Case

Kernel warning messages in logs and failure of network interface queries (like 'ip link show') when systems have many VF GUIDs configured, causing operational disruption for network management tools.

🟢

If Mitigated

Minor performance impact or warning messages in kernel logs without system instability if the warning is handled gracefully.

🌐 Internet-Facing: LOW - This vulnerability requires local access or privileged network access to trigger via netlink commands.

🏢 Internal Only: MEDIUM - Internal administrators or processes with CAP_NET_ADMIN capabilities can trigger this, potentially disrupting network management operations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: LOW - Requires CAP_NET_ADMIN privileges and knowledge of triggering commands

Exploitation requires local access with appropriate privileges. The vulnerability is triggered by legitimate administrative commands rather than malicious payloads.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 0f5489707cf528f9df2f39a3045c1ee713ec90e7, 15f150771e0ec97f8ab1657e7d2568e593c7fa04, 23f00807619d15063d676218f36c5dfeda1eb420, 28b21ee8e8fb326ba961a4bbce04ec04c65e705a, 365c1ae819455561d4746aafabad673e4bcb0163

Vendor Advisory: https://git.kernel.org/stable/c/0f5489707cf528f9df2f39a3045c1ee713ec90e7

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for backported patches. 3. Reboot the system after kernel update. 4. Verify the fix by checking kernel version and testing 'ip link show' commands on affected interfaces.

🔧 Temporary Workarounds

Limit SR-IOV VF count

linux

Reduce the number of Virtual Functions configured via SR-IOV to avoid triggering the memory allocation issue

echo <reduced_number> > /sys/bus/pci/devices/<device_address>/sriov_numvfs

Avoid VF GUID queries

linux

Avoid using 'ip link show' or similar netlink commands on affected InfiniBand interfaces

🧯 If You Can't Patch

Monitor kernel logs for WARNING messages from rtnl_getlink function
Implement strict access controls to limit who can run network interface query commands

🔍 How to Verify

Check if Vulnerable:

Run 'ip link show' on an InfiniBand interface with many VFs configured and check for 'Message too long' errors or examine kernel logs for warnings from rtnl_getlink

Check Version:

uname -r

Verify Fix Applied:

After patching, run 'ip link show' on previously affected interfaces and verify no errors occur, and check kernel logs for absence of rtnl_getlink warnings

📡 Detection & Monitoring

Log Indicators:

Kernel WARNING messages containing 'rtnl_getlink'
'Message too long' errors in application logs when querying network interfaces
Stack traces mentioning rtnetlink.c:4151

Network Indicators:

Failed network interface queries from monitoring systems

SIEM Query:

source="kernel" AND "WARNING" AND "rtnl_getlink" OR source="syslog" AND "Message too long" AND "ip link"

📊 Metadata

CVE ID: CVE-2025-22075

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.11% exploit probability (29.1th percentile)

Published: April 16, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON