CVE-2025-21997 is a medium severity vulnerability in the Linux kernel's xsk component involving an integer overflow in the xp_create_and_assign_umem() function. The overflow occurs because the product of two 32-bit unsigned integers can wrap around before being cast to a 64-bit integer, potentially causing two different XDP buffers to reference the same memory area. This flaw was discovered by InfoTeCS on behalf of the Linux Verification Center. No known exploits are reported in the wild.