High 7.1Published Apr 16, 2025

CVE-2025-22107net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()

Updated under an hour ago (Oct 27, 2026, 7:30 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() There are actually 2 problems: - deleting the last element doesn't require the memmove of elements [i + 1, end) over it. Actually, element i+1 is out of bounds. - The memmove itself should move size - i - 1 elements, because the last element is out of bounds. The out-of-bounds element still remains out of bounds after being accessed, so the problem is only that we touch it, not that it becomes in active use. But I suppose it can lead to issues if the out-of-bounds element is part of an unmapped page.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 before f85b9bfb08ba2b642d1810c6c4ae1e7b46f1776a; from 6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 before f117d0467215d7f1d445ae16d2c799637e63dc6c; from 6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 before b52153da1f42e2f4d6259257a7ba027331671a93; from 6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 before 4584486cfcca24b7b586da3377eb3cffd48669ec; 6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 builds before 031e00249e9e6bee72ba66701c8f83b45fc4b8a2; 6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 builds before 59b97641de03c081f26b3a8876628c765b5faa25; 6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 builds before 5f2b28b79d2d1946ee36ad8b3dc0066f73c90481	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.2 before 6.14.2	NVD

References

References

https://git.kernel.org/stable/c/f85b9bfb08ba2b642d1810c6c4ae1e7b46f1776a
https://git.kernel.org/stable/c/f117d0467215d7f1d445ae16d2c799637e63dc6c
https://git.kernel.org/stable/c/b52153da1f42e2f4d6259257a7ba027331671a93
https://git.kernel.org/stable/c/4584486cfcca24b7b586da3377eb3cffd48669ec
https://git.kernel.org/stable/c/031e00249e9e6bee72ba66701c8f83b45fc4b8a2
https://git.kernel.org/stable/c/59b97641de03c081f26b3a8876628c765b5faa25	patch
https://git.kernel.org/stable/c/5f2b28b79d2d1946ee36ad8b3dc0066f73c90481	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.