Executive brief
A vulnerability was identified in the Linux kernel's networking component that could allow an attacker to cause a system crash or potentially execute unauthorized code. The issue exists in how the system handles IPv4 network traffic, specifically during packet fragmentation and routing. This could lead to service outages or a complete compromise of the affected server.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel IPv4 stack due to improper RCU (Read-Copy-Update) handling of destination devices. The flaw is located in multiple functions including icmpv4_xrlim_allow(), ip_defrag(), ipmr_prepare_xmit(), and ipv4_neigh_lookup(). By failing to use dst_dev_rcu(), the kernel may attempt to access a network device object after it has been freed. An attacker can trigger this via network-based vectors without authentication, potentially achieving remote code execution or a kernel panic. The issue has been resolved by transitioning these components to use RCU-enabled destination device lookups.
Affected products
- Linux Linux Kernel 4.13 to 6.17.x
Timeline
- 2025-08-28: patched: Initial fix commit authored by Eric Dumazet
- 2025-10-28: disclosed: CVE published and NVD record created