CVE-2025-21972CWE-401

CVE-2025-21972

High · published April 1, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: unshare packets when reassembling

Ensure that the frag_list used for reassembly isn't shared with other

packets. This avoids incorrect reassembly when packets are cloned, and

prevents a memory leak due to circular references between fragments and

their skb_shared_info.

The upcoming MCTP-over-USB driver uses skb_clone which can trigger the

problem - other MCTP drivers don't share SKBs.

A kunit test is added to reproduce the issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00232 · 13.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2025-04-01T20:15Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 5.15, < 6.12.206.12.20
linux/linux_kernel≥ 6.13, < 6.13.86.13.8
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (4)
https://git.kernel.org/stable/c/3d0281d0713952e8dd14d6d47e3a9c345c28a3b7 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5c47d5bfa7b096cf8890afac32141c578583f8e0 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f44fff3d3c6cd67b6f348b821d73c4d6888c7a6e · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 01 APR 15:47Z
    net: mctp: unshare packets when reassembling
    cvelistv5