Executive brief
A memory leak vulnerability exists in the Linux kernel's networking component. This flaw occurs when the system handles specific types of network socket connections using BPF programs. A local attacker could exploit this to gradually consume system memory, potentially leading to a system crash or denial of service.
Technical details
A memory leak (CWE-401) exists in net/core/filter.c within the bpf_sk_select_reuseport() function. The vulnerability is caused by failing to drop a socket reference (sock_put) in certain error paths when a lookup in a sockmap returns a TCP ESTABLISHED socket. Specifically, if a socket has sk_reuseport_cb set but fails subsequent protocol or family checks, the reference count is not properly decremented. This allows a local user to exhaust kernel memory by repeatedly triggering these error paths. Patches have been released for various stable kernel branches including 5.15.177, 6.1.127, 6.6.74, and 6.12.11.
Affected products
- Linux Linux Kernel 5.8 to 5.15.177, 5.16 to 6.1.127, 6.2 to 6.6.74, 6.7 to 6.12.11, 6.13-rc1 to 6.13-rc7
Timeline
- 2025-01-10: patched: Initial patch submitted to kernel.org
- 2025-01-31: disclosed: CVE-2025-21683 published
References
- https://git.kernel.org/stable/c/0ab52a8ca6e156a64c51b5e7456cac9a0ebfd9bf
- https://git.kernel.org/stable/c/b02e70be498b138e9c21701c2f33f4018ca7cd5e
- https://git.kernel.org/stable/c/b3af60928ab9129befa65e6df0310d27300942bf
- https://git.kernel.org/stable/c/bb36838dac7bb334a3f3d7eb29875593ec9473fc
- https://git.kernel.org/stable/c/cccd51dd22574216e64e5d205489e634f86999f3
- https://git.kernel.org/stable/c/d0a3b3d1176d39218b8edb2a2d03164942ab9ccd
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html