Executive brief
A vulnerability exists in the Linux kernel's IP Virtual Server (IPVS) component, which is used for load balancing network traffic. During the cleanup of network namespaces, the system may prematurely remove FTP-related components while they are still being accessed by active connections. This could lead to a system crash or allow a local attacker to gain unauthorized control over the system.
Technical details
A use-after-free (UAF) vulnerability exists in net/netfilter/ipvs/ip_vs_ftp.c within the Linux kernel. The root cause is a race condition during network namespace (netns) cleanup where __ip_vs_ftp_exit() unregisters the ip_vs_ftp application helper before all connections associated with valid cp->app pointers are fully flushed. A local attacker can exploit this timing issue to trigger a UAF condition, potentially leading to kernel memory corruption, privilege escalation, or a denial of service. The fix introduces a global 'exiting_module' flag to ensure unregistration is deferred to __ip_vs_cleanup_batch() during netns cleanup, ensuring all connections are flushed first. Patches have been released for various stable kernel branches including 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.11.y.
Affected products
- Linux Linux Kernel 2.6.39 to 6.11.x
Timeline
- 2025-10-24: advisory: CVE published by kernel.org
- 2025-09-24: patched: Initial patch committed to stable tree
References
- https://git.kernel.org/stable/c/134121bfd99a06d44ef5ba15a9beb075297c0821
- https://git.kernel.org/stable/c/1d79471414d7b9424d699afff2aa79fff322f52d
- https://git.kernel.org/stable/c/421b1ae1574dfdda68b835c15ac4921ec0030182
- https://git.kernel.org/stable/c/53717f8a4347b78eac6488072ad8e5adbaff38d9
- https://git.kernel.org/stable/c/8a6ecab3847c213ce2855b0378e63ce839085de3
- https://git.kernel.org/stable/c/8cbe2a21d85727b66d7c591fd5d83df0d8c4f757
- https://git.kernel.org/stable/c/a343811ef138a265407167294275201621e9ebb2