PT-2025-4311 · Linux · Linux Kernel

Published 2025-01-15 · Updated 2025-01-17 · CVE-2025-21630

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability has been resolved in the Linux kernel. The issue is related to the io uring/net component, where the kmsg->msg.msg inq variable may be used uninitialized. This can occur when the recv operation is not successful and the networking stack does not honor the ->msg get inq setting, resulting in the output value of ->msg inq not being filled as requested. The vulnerability can cause the next receive operation to use an inaccurate receive value hint. There is no side effect of using the uninitialized variable, but it may lead to inaccurate receive value hints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-21630

Affected Products

Linux Kernel

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-21630 · Security Note
• https://ubuntu.com/security/CVE-2025-21630 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-21630 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-21630 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-21630 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-21630 · Vendor Advisory
• https://git.kernel.org/stable/c/c6e60a0a68b7e6b3c7e33863a16e8e88ba9eee6f · Note
• https://git.kernel.org/stable/c/127c280067167beb88461cd930f7c7a4bb3c7239 · Note
• https://twitter.com/CVEnew/status/1879858750166810983 · Twitter Post
• https://t.me/cvedetector/15442 · Telegram Post
• https://git.kernel.org/linus/c6e60a0a68b7e6b3c7e33863a16e8e88ba9eee6f · Note