Riskcovery

CVE-2025-21759

ipv6: mcast: extend RCU protection in igmp6_send()

State
Published
Severity
7.8 High
Published
Feb 27, 2025
Updated
Oct 3, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: extend RCU protection in igmp6_send()

igmp6_send() can be called without RTNL or RCU being held.

Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF.

Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.

Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551 to before 638e8fe3563a82f298fe537a28d5342a97278cf1Affected
  • b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551 to before 6901bbb169e3add6c037218d996790cef6b3d650Affected
  • b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551 to before 7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dffAffected
  • b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551 to before 81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5aAffected
  • b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551 to before 0bf8e2f3768629d437a32cb824149e6e98254381Affected
  • b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551 to before 8e92d6a413feaf968a33f0b439ecf27404407458Affected
  • b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551 to before 087c1faa594fa07a66933d750c0b2610aa1a2946Affected
LinuxLinux
  • 2.6.26Affected
  • before 2.6.26Not affected
  • 5.10.271 through 5.10.*Not affected
  • 5.15.222 through 5.15.*Not affected
  • 6.1.189 through 6.1.*Not affected
  • 6.6.79 through 6.6.*Not affected
  • 6.12.16 through 6.12.*Not affected
  • 6.13.4 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.