CVE-2025-21854 is a vulnerability identified in the Linux kernel's handling of vsock (virtual socket) connections within the sockmap subsystem. Sockmap is a kernel feature that allows efficient packet processing by using BPF (Berkeley Packet Filter) programs on socket data paths. The vulnerability arises from an edge case in the management of connectible vsocks, where a socket that is supposed to have an assigned transport protocol may lose this assignment unexpectedly. Specifically, the vsock_proto::psock_update_sk_prot() function is responsible for assigning transport to vsocks, but an unconnected connectible socket can lose its transport assignment. This leads to a scenario where a listening vsock, which by design should not have any transport assigned, might still be present in the sockmap due to a failed connect() attempt prior to switching to TCP_LISTEN state. This inconsistency causes a null pointer dereference in the kernel, as evidenced by the KASAN (Kernel Address Sanitizer) error logs showing a null pointer dereference in the vsock_read_skb() function. The flaw can cause kernel crashes (denial of service) or potentially enable further exploitation depending on the kernel's state and configuration. The fix involves modifying sockmap to only allow connectible sockets that represent established connections, aligning vsock behavior with that of AF_INET and AF_UNIX sockets, thereby preventing unconnected or listening sockets without proper transport from being included in sockmap. This vulnerability affects Linux kernel versions around 6.14.0-rc1 and likely other versions with similar sockmap and vsock implementations. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions that utilize vsock and sockmap features, which are common in environments leveraging virtualization, containerization, and advanced networking setups. The impact includes potential kernel crashes leading to denial of service, which can disrupt critical services, especially in data centers, cloud providers, and enterprises relying on Linux-based infrastructure. While direct remote code execution is not indicated, the instability caused by kernel null pointer dereferences can be leveraged in chained attacks or cause significant operational disruptions. Organizations in sectors such as finance, telecommunications, and critical infrastructure that depend on high availability Linux servers could experience service outages or degraded performance. Additionally, since vsock is often used for communication between virtual machines and host systems, this vulnerability could affect virtualization platforms widely used in European data centers. The lack of known exploits reduces immediate risk, but the vulnerability's presence in kernel code means that attackers with local access or the ability to trigger vsock connections could exploit it to cause denial of service or potentially escalate privileges.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched, specifically versions beyond 6.14.0-rc1 that include the fix restricting sockmap to only established connectible sockets. System administrators should audit their environments to identify systems running vulnerable kernel versions, especially those using virtualization or container platforms that leverage vsock communication. In environments where immediate patching is not feasible, organizations should restrict access to systems that can create vsock connections, limit untrusted user access, and monitor kernel logs for signs of null pointer dereference errors or crashes related to vsock operations. Additionally, disabling or limiting the use of sockmap and vsock features where not required can reduce the attack surface. Implementing kernel hardening techniques such as KASAN and enabling kernel crash dump analysis can help detect and respond to exploitation attempts. Coordination with Linux distribution vendors for timely patch deployment and testing is also recommended to ensure stability and security.