CVE-2025-21759CWE-416

CVE-2025-21759

High · published February 27, 2025

CVSS v3.1
7.8
EPSS
8%
Percentile
94.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: extend RCU protection in igmp6_send()

igmp6_send() can be called without RTNL or RCU being held.

Extend RCU protection so that we can safely fetch the net pointer

and avoid a potential UAF.

Note that we no longer can use sock_alloc_send_skb() because

ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.

Instead use alloc_skb() and charge the net->ipv6.igmp_sk

socket under RCU protection.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07804 · 94.7th percentile
Weakness
CWE-416 · Use After Free
Published
2025-02-27T08:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 2.6.26, < 6.6.796.6.79
linux/linux_kernel≥ 6.7, < 6.12.166.12.16
linux/linux_kernel≥ 6.13, < 6.13.46.13.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (7)
EPSS history
Timeline
  • 27 FEB 02:18Z
    ipv6: mcast: extend RCU protection in igmp6_send()
    cvelistv5