CVE-2025-21766

ipv4: use RCU protection in __ip_rt_update_pmtu()

State: Published
Severity: 8.1 High
Published: Feb 27, 2025
Updated: Oct 15, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: use RCU protection in __ip_rt_update_pmtu()

__ip_rt_update_pmtu() must use RCU protection to make sure the net structure it reads does not disappear.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before ce3c6165fce0f06305c806696882a3ad4b90e33fAffected 2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before ea07480b23225942208f1b754fea1e7ec486d37eAffected 2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before 9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4Affected 2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before 4583748b65dee4d61bd50a2214715b4237bc152aAffected 2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before a39f61d212d822b3062d7f70fa0588e50e55664eAffected 2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before 139512191bd06f1b496117c76372b2ce372c9a41Affected f415c264176e6095e9dee823e09c5bdd0ee0d337Affected 98776a365da509ad923083ae54b38ee521c52742Affected 860e2cc78c697c95bc749abb20047239fa1722eaAffected 2b1be6c925cdf4638811765a9160796291494b89Affected 4.14.200 to before 4.15Affected 4.19.148 to before 4.20Affected 5.4.68 to before 5.5Affected 5.8.12 to before 5.9Affected
LinuxLinux	5.9Affected before 5.9Not affected 5.15.179 through 5.15.Not affected 6.1.129 through 6.1.Not affected 6.6.79 through 6.6.Not affected 6.12.16 through 6.12.Not affected 6.13.4 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before ce3c6165fce0f06305c806696882a3ad4b90e33fAffected
2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before ea07480b23225942208f1b754fea1e7ec486d37eAffected
2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before 9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4Affected
2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before 4583748b65dee4d61bd50a2214715b4237bc152aAffected
2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before a39f61d212d822b3062d7f70fa0588e50e55664eAffected
2fbc6e89b2f1403189e624cabaf73e189c5e50c6 to before 139512191bd06f1b496117c76372b2ce372c9a41Affected
f415c264176e6095e9dee823e09c5bdd0ee0d337Affected
98776a365da509ad923083ae54b38ee521c52742Affected
860e2cc78c697c95bc749abb20047239fa1722eaAffected
2b1be6c925cdf4638811765a9160796291494b89Affected
4.14.200 to before 4.15Affected
4.19.148 to before 4.20Affected
5.4.68 to before 5.5Affected
5.8.12 to before 5.9Affected

LinuxLinux

5.9Affected
before 5.9Not affected
5.15.179 through 5.15.*Not affected
6.1.129 through 6.1.*Not affected
6.6.79 through 6.6.*Not affected
6.12.16 through 6.12.*Not affected
6.13.4 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.