Homepage

CVE-2025-21895 Affecting kernel-uek-modules-extra-netfilter package, versions <0:6.12.0-101.33.4.3.el9uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.03% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-KERNELUEKMODULESEXTRANETFILTER-10790083
  • published19 Jul 2025
  • disclosed1 Apr 2025
Report a new vulnerability Found a mistake?

Introduced: 1 Apr 2025

CVE-2025-21895  (opens in a new tab)

How to fix?

Upgrade Oracle:9 kernel-uek-modules-extra-netfilter to version 0:6.12.0-101.33.4.3.el9uek or higher.
This issue was patched in ELSA-2025-20480.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-modules-extra-netfilter package and not the kernel-uek-modules-extra-netfilter package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list

Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same perf_event_pmu_context, but not in the same order.

The problem is that the order of pmu_ctx_list for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinned_groups and flexible_groups. So the order of pmu_ctx_list in the parent and child may be different.

To fix this problem, insert the perf_event_pmu_context to its proper place after iteration of the pmu_ctx_list.

The follow testcase can trigger above warning:

perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out &

perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out

test.c

void main() { int count = 0; pid_t pid;

    printf(&#34;%d running\n&#34;, getpid());
    sleep(30);
    printf(&#34;running\n&#34;);


pid = fork();
if (pid == -1) {
        printf(&amp;#34;fork error\n&amp;#34;);
        return;
}
if (pid == 0) {
        while (1) {
                count++;
        }
} else {
        while (1) {
                count++;
        }
}

}

The testcase first opens an LBR event, so it will allocate task_ctx_data, and then open tracepoint and software events, so the parent context will have 3 different perf_event_pmu_contexts. On inheritance, child ctx will insert the perf_event_pmu_context in another order and the warning will trigger.

[ mingo: Tidied up the changelog. ]

CVSS Base Scores

version 3.1