CVE-2025-21922: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-21922) was discovered in the Linux kernel's PPP driver, where a 2-byte header is not properly initialized when using socket filter. The issue was identified on January 4, 2025, affecting multiple versions of the Linux kernel from 2.6.12 up to versions prior to 6.14 (NVD).

The vulnerability stems from the PPP driver not initializing a 2-byte header when using socket filter. When using BPF (Berkeley Packet Filter) programs, particularly those generated by libpcap, the first byte indicating direction is initialized, but the second byte remains uninitialized. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and is classified as CWE-908 (Use of Uninitialized Resource) (NVD).

The vulnerability could lead to potential information leaks or system instability when specially crafted BPF programs access the uninitialized data. While normal BPF programs generated by libpcap won't trigger the issue, carefully crafted programs, such as those generated by syzkaller, can access and use the uninitialized data (NVD).

The vulnerability requires local access and low attack complexity to exploit. It has been detected by the Kernel Memory Sanitizer (KMSAN) tool, specifically through syzkaller-generated test cases that can access the uninitialized memory (NVD).

The vulnerability has been addressed in various Linux kernel versions. Debian has released security updates in version 6.1.133-1 for their stable distribution (bookworm) (Debian Security). Multiple patches have been released through the kernel.org repository to fix the issue across different kernel versions (NVD).