Junglewise Threat Intelligence

CVE-2025-21864: Linux Kernel resource leak in TCP receive path

CVE-2025-21864 · Severity: medium · CVSS 5.5 · Published 2025-03-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to cause a system hang or crash. The issue occurs when the system fails to properly release internal security references during certain network operations, particularly when deleting network namespaces. This can lead to resource exhaustion or kernel warnings that disrupt normal operations and system availability.

Technical details

A vulnerability in the Linux kernel TCP stack involves a failure to drop the 'secpath' (security path) reference from a socket buffer (skb) at the same time the destination (dst) reference is dropped. This occurs when skbs are placed on a per-CPU defer_list for freeing; if the associated network namespace is deleted before the list is flushed, a lingering reference to the xfrm_state remains. This prevents the proper cleanup of IPsec-related states, leading to kernel warnings (WARN in xfrm6_tunnel_net_exit) and potential resource leaks. The fix introduces tcp_cleanup_skb to ensure both dst and secpath are reset during the TCP receive path.

Affected products

  • Linux Linux Kernel 5.19 to 6.1.130, 6.2 to 6.6.80, 6.7 to 6.12.17, 6.13 to 6.13.5, 6.14-rc1 to 6.14-rc3

Timeline

  • 2025-02-17: patched: Initial patch authored by Sabrina Dubroca
  • 2025-03-12: advisory: CVE-2025-21864 published

References

Related threats