CVE-2025-21972

net: mctp: unshare packets when reassembling

State: Published
Severity: 8.8 High
Published: Apr 1, 2025
Updated: Oct 30, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: unshare packets when reassembling

Ensure that the frag_list used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and prevents a memory leak due to circular references between fragments and their skb_shared_info.

The upcoming MCTP-over-USB driver uses skb_clone which can trigger the problem - other MCTP drivers don't share SKBs.

A kunit test is added to reproduce the issue.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4a992bbd365094730a31bae1e12a6ca695336d57 to before 771087069a27c35c0a9fd7cc74fe7725b189b96bAffected 4a992bbd365094730a31bae1e12a6ca695336d57 to before 3d0281d0713952e8dd14d6d47e3a9c345c28a3b7Affected 4a992bbd365094730a31bae1e12a6ca695336d57 to before 5c47d5bfa7b096cf8890afac32141c578583f8e0Affected 4a992bbd365094730a31bae1e12a6ca695336d57 to before f44fff3d3c6cd67b6f348b821d73c4d6888c7a6eAffected 4a992bbd365094730a31bae1e12a6ca695336d57 to before f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeeccAffected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.20 through 6.12.Not affected 6.13.8 through 6.13.Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

4a992bbd365094730a31bae1e12a6ca695336d57 to before 771087069a27c35c0a9fd7cc74fe7725b189b96bAffected
4a992bbd365094730a31bae1e12a6ca695336d57 to before 3d0281d0713952e8dd14d6d47e3a9c345c28a3b7Affected
4a992bbd365094730a31bae1e12a6ca695336d57 to before 5c47d5bfa7b096cf8890afac32141c578583f8e0Affected
4a992bbd365094730a31bae1e12a6ca695336d57 to before f44fff3d3c6cd67b6f348b821d73c4d6888c7a6eAffected
4a992bbd365094730a31bae1e12a6ca695336d57 to before f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeeccAffected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.20 through 6.12.*Not affected
6.13.8 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.