Junglewise Threat Intelligence

CVE-2025-21765: Linux Kernel race condition in IPv6 ip6_default_advmss

CVE-2025-21765 · Severity: medium · CVSS 5.5 · Published 2025-02-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's IPv6 networking component. The issue occurs when the system calculates certain network transmission settings, potentially allowing the system to access memory that is no longer valid. If exploited, this could lead to a system crash or instability, resulting in a denial of service.

Technical details

The vulnerability is a race condition within the IPv6 routing component of the Linux kernel, specifically in the ip6_default_advmss() function. The function lacked Read-Copy-Update (RCU) protection when accessing the 'net' structure via a network device. Without this protection, the namespace structure could be deallocated while still being read, leading to a use-after-free or null pointer dereference. A local attacker with low privileges could potentially trigger this condition to cause a kernel panic (Denial of Service). The fix introduces rcu_read_lock() and uses dev_net_rcu() to ensure the network namespace structure remains valid during the operation. Patching is available across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 2.6.26 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4

Timeline

  • 2025-02-05: patched: Initial patch authored by Eric Dumazet
  • 2025-02-26: advisory: CVE-2025-21765 published by kernel.org
  • 2025-02-27: disclosed: NVD publication date

References

Related threats