CVE-2025-22117

In the Linux kernel, the following vulnerability has been resolved:

ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()

Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed the VIRTCHNL_MAX_SIZE_RAW_PACKET value.

A low severity flaw was found in the Linux kernel's ice network driver in the flow director handling for virtual functions. When a virtual function (VF) on an Intel Ethernet Controller E810-based ice NIC sends a VIRTCHNL flow director request, the ice_vc_fdir_parse_raw() function in drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c uses the VF-supplied raw packet length (proto->raw.pkt_len) without first verifying that it does not exceed VIRTCHNL_MAX_SIZE_RAW_PACKET. A highly privileged local attacker, such as one who controls the guest virtual machine that owns the VF, could use this flaw to cause out-of-bounds memory access in the host kernel, resulting in a denial of service (kernel crash). Red Hat rates this flaw Low impact (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) because exploitation requires high privileges and affects only the availability of the host; this differs from the higher CVE.org severity (8.7, Important), which assumes broader scope and confidentiality/integrity impact that the available technical evidence does not support.

In Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt), this flaw is rated affected and the fix is currently deferred to a future update because of the low severity and the high privileges required for exploitation; the residual risk is limited to a local denial of service by an attacker who already controls a guest virtual machine with an ice VF on the host. Red Hat Enterprise Linux 6, 7, and 8, Red Hat In-Vehicle OS, and Red Hat's hosted OpenShift offerings (ARO and OSD) are not affected because the vulnerable code is not present in their kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.