Vulnerability · CVE-2025-22105

In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip ne

Q: Which versions are affected?

Compare what you have installed with Linux Linux 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e <0dd4fac43bdea23cfe4bb2a3eabb76d752ac32fb 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e <0dd4fac43bdea23cfe4bb2a3eabb76d752ac32fb. Compare the installed version with the linked vendor advisory before you change production.

Q: What should an analyst verify?

No weakness class is stored. EPSS 20.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published Apr 16, 2025 · catalog updated Oct 15, 2026 · Linux Linux

Check this week

CVE-2025-22105 is not in CISA KEV. FIRST estimates a 20.00% chance of exploitation in the next 30 days. Check whether you run Linux Linux.

Gaps on this record

No vendor fix or required action is stored. Compare the linked advisory before you change production.

Severity: Medium5.5
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 20.00%
Remediation: Version ranges on file
Affected products: cpe linux/linux kernel · vendor Linux Linux 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e <0dd4fac43bdea23cfe4bb2a3eabb76d752ac32fb

In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp ip netns exec ns1 ip link set bond0 type bond mode broadcast ip netns del ns1 When delete the namespace, dev_xdp_uninstall() is called to remove xdp program on bond dev, and bond_xdp_set() will check the bond mode. If bond mode is changed after attaching xdp program, the warning may occur. Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode with xdp program attached is not good. Add check for xdp program when set bond mode. [1] ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930 Modules linked in: CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930 Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ... RSP: 0018:ffffc90000063d80 EFLAGS: 00000282 RAX: 00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48 RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb R10: 0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8 R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000 FS: 0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0 Call Trace: ? __warn+0x83/0x130 ? unregister_netdevice_many_notify+0x8d9/0x930 ? report_bug+0x18e/0x1a0 ? handle_bug+0x54/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ?

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

cpe linux/linux kernelversion unspecified
vendor Linux Linux 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e <0dd4fac43bdea23cfe4bb2a3eabb76d752ac32fb9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e <0dd4fac43bdea23cfe4bb2a3eabb76d752ac32fb

How to fix CVE-2025-22105

Recommended remediation
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2025-22105 is not in CISA KEV. FIRST estimates a 20.00% chance of exploitation in the next 30 days. Check whether you run Linux Linux.

Which versions are affected?

Compare what you have installed with Linux Linux 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e <0dd4fac43bdea23cfe4bb2a3eabb76d752ac32fb 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e <0dd4fac43bdea23cfe4bb2a3eabb76d752ac32fb. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 20.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Apr 16, 2025 · NIST NVD
Detected
In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp ip netns exec ns1 ip link set bond0 type bond mode broadcast ip netns del ns1 When delete the
Oct 15, 2026 · NIST NVD
Updated
In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp ip netns exec ns1 ip link set bond0 type bond mode broadcast ip netns del ns1 When delete the

Sources

CVE.orgVulnerability recordCVE-2025-22105
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2025-22105
30-day exploitation probability 20.0%
first.org
EUVDVulnerability recordEUVD-2025-11177
In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp
euvd.enisa.europa.eu
NIST NVDVulnerability recordCVE-2025-22105
In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link se
nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Priority score

17/100

Evidence confidence: High

A vendor or government advisory agrees with at least one other source.

Confirmed exploitation0/30
EPSS probability4/20
CVSS severity8/15
Public exploit0/10
Internet exposure0/10
Product prevalence5/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Medium

CVSS severity
5.5 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS probability
20.00% · p9.71%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Version ranges on file
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.

Stacks

Linux

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.