CVE-2025-21903: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21903 is a vulnerability discovered in the Linux kernel's MCTP (Management Component Transport Protocol) I3C implementation. The vulnerability was disclosed on April 1, 2025, and affects the handling of NULL header addresses in the MCTP I3C component (NVD, CVE).

The vulnerability occurs in the MCTP I3C component where daddr (destination address) can be NULL if there is no neighbor table entry present. Additionally, while saddr (source address) is typically set by the MCTP core, there's a possibility of it being NULL when a packet is transmitted by a different protocol (NVD).

When the vulnerability is triggered, it can lead to improper packet handling in the Linux kernel's MCTP I3C implementation. The specific impact involves packets that should be dropped when encountering NULL header addresses (NVD).

The vulnerability has been resolved in the Linux kernel through patches that implement proper handling of NULL header addresses. The fix ensures that tx packets are dropped when daddr is NULL, and includes additional checks for NULL saddr when packets are transmitted by different protocols (NVD).