CVE-2025-21864 (GCVE-0-2025-21864)
Vulnerability from cvelistv5
Published
2025-03-12 09:42
Modified
2025-05-04 07:22
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to: - create a pair of netns - run a basic TCP test over ipcomp6 - delete the pair of netns The xfrm_state found on spi_byaddr was not deleted at the time we delete the netns, because we still have a reference on it. This lingering reference comes from a secpath (which holds a ref on the xfrm_state), which is still attached to an skb. This skb is not leaked, it ends up on sk_receive_queue and then gets defer-free'd by skb_attempt_defer_free. The problem happens when we defer freeing an skb (push it on one CPU's defer_list), and don't flush that list before the netns is deleted. In that case, we still have a reference on the xfrm_state that we don't expect at this point. We already drop the skb's dst in the TCP receive path when it's no longer needed, so let's also drop the secpath. At this point, tcp_filter has already called into the LSM hooks that may require the secpath, so it should not be needed anymore. However, in some of those places, the MPTCP extension has just been attached to the skb, so we cannot simply drop all extensions.
References
Impacted products
Vendor Product Version
Linux Linux Version: 68822bdf76f10c3dc80609d4e2cdc1e847429086
Version: 68822bdf76f10c3dc80609d4e2cdc1e847429086
Version: 68822bdf76f10c3dc80609d4e2cdc1e847429086
Version: 68822bdf76f10c3dc80609d4e2cdc1e847429086
Version: 68822bdf76f10c3dc80609d4e2cdc1e847429086
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/tcp.h",
            "net/ipv4/tcp_fastopen.c",
            "net/ipv4/tcp_input.c",
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87858bbf21da239ace300d61dd209907995c0491",
              "status": "affected",
              "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086",
              "versionType": "git"
            },
            {
              "lessThan": "f1d5e6a5e468308af7759cf5276779d3155c5e98",
              "status": "affected",
              "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086",
              "versionType": "git"
            },
            {
              "lessThan": "cd34a07f744451e2ecf9005bb7d24d0b2fb83656",
              "status": "affected",
              "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086",
              "versionType": "git"
            },
            {
              "lessThan": "69cafd9413084cd5012cf5d7c7ec6f3d493726d9",
              "status": "affected",
              "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086",
              "versionType": "git"
            },
            {
              "lessThan": "9b6412e6979f6f9e0632075f8f008937b5cd4efd",
              "status": "affected",
              "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/tcp.h",
            "net/ipv4/tcp_fastopen.c",
            "net/ipv4/tcp_input.c",
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.130",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.80",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.17",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.5",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: drop secpath at the same time as we currently drop dst\n\nXiumei reported hitting the WARN in xfrm6_tunnel_net_exit while\nrunning tests that boil down to:\n - create a pair of netns\n - run a basic TCP test over ipcomp6\n - delete the pair of netns\n\nThe xfrm_state found on spi_byaddr was not deleted at the time we\ndelete the netns, because we still have a reference on it. This\nlingering reference comes from a secpath (which holds a ref on the\nxfrm_state), which is still attached to an skb. This skb is not\nleaked, it ends up on sk_receive_queue and then gets defer-free\u0027d by\nskb_attempt_defer_free.\n\nThe problem happens when we defer freeing an skb (push it on one CPU\u0027s\ndefer_list), and don\u0027t flush that list before the netns is deleted. In\nthat case, we still have a reference on the xfrm_state that we don\u0027t\nexpect at this point.\n\nWe already drop the skb\u0027s dst in the TCP receive path when it\u0027s no\nlonger needed, so let\u0027s also drop the secpath. At this point,\ntcp_filter has already called into the LSM hooks that may require the\nsecpath, so it should not be needed anymore. However, in some of those\nplaces, the MPTCP extension has just been attached to the skb, so we\ncannot simply drop all extensions."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:22:47.376Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87858bbf21da239ace300d61dd209907995c0491"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1d5e6a5e468308af7759cf5276779d3155c5e98"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd34a07f744451e2ecf9005bb7d24d0b2fb83656"
        },
        {
          "url": "https://git.kernel.org/stable/c/69cafd9413084cd5012cf5d7c7ec6f3d493726d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b6412e6979f6f9e0632075f8f008937b5cd4efd"
        }
      ],
      "title": "tcp: drop secpath at the same time as we currently drop dst",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21864",
    "datePublished": "2025-03-12T09:42:21.223Z",
    "dateReserved": "2024-12-29T08:45:45.780Z",
    "dateUpdated": "2025-05-04T07:22:47.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21864\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-12T10:15:19.520\",\"lastModified\":\"2025-03-13T21:13:34.190\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: drop secpath at the same time as we currently drop dst\\n\\nXiumei reported hitting the WARN in xfrm6_tunnel_net_exit while\\nrunning tests that boil down to:\\n - create a pair of netns\\n - run a basic TCP test over ipcomp6\\n - delete the pair of netns\\n\\nThe xfrm_state found on spi_byaddr was not deleted at the time we\\ndelete the netns, because we still have a reference on it. This\\nlingering reference comes from a secpath (which holds a ref on the\\nxfrm_state), which is still attached to an skb. This skb is not\\nleaked, it ends up on sk_receive_queue and then gets defer-free\u0027d by\\nskb_attempt_defer_free.\\n\\nThe problem happens when we defer freeing an skb (push it on one CPU\u0027s\\ndefer_list), and don\u0027t flush that list before the netns is deleted. In\\nthat case, we still have a reference on the xfrm_state that we don\u0027t\\nexpect at this point.\\n\\nWe already drop the skb\u0027s dst in the TCP receive path when it\u0027s no\\nlonger needed, so let\u0027s also drop the secpath. At this point,\\ntcp_filter has already called into the LSM hooks that may require the\\nsecpath, so it should not be needed anymore. However, in some of those\\nplaces, the MPTCP extension has just been attached to the skb, so we\\ncannot simply drop all extensions.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp: descartar secpath al mismo tiempo que descartamos dst Xiumei inform\u00f3 haber alcanzado el WARN en xfrm6_tunnel_net_exit mientras ejecutaba pruebas que se reducen a: - crear un par de netns - ejecutar una prueba TCP b\u00e1sica sobre ipcomp6 - eliminar el par de netns El xfrm_state encontrado en spi_byaddr no se elimin\u00f3 en el momento en que eliminamos los netns, porque a\u00fan tenemos una referencia en \u00e9l. Esta referencia persistente proviene de un secpath (que contiene una referencia en xfrm_state), que a\u00fan est\u00e1 adjunto a un skb. Este skb no se filtra, termina en sk_receive_queue y luego se libera mediante skb_attempt_defer_free. El problema ocurre cuando posponemos la liberaci\u00f3n de un skb (insertarlo en la lista defer_list de una CPU) y no limpiamos esa lista antes de eliminar netns. En ese caso, a\u00fan tenemos una referencia en xfrm_state inesperada en este momento. Ya eliminamos el dst del skb en la ruta de recepci\u00f3n TCP cuando ya no es necesario, as\u00ed que tambi\u00e9n eliminamos el secpath. En este punto, tcp_filter ya ha llamado a los ganchos LSM que podr\u00edan requerir el secpath, por lo que ya no deber\u00eda ser necesario. Sin embargo, en algunos de esos lugares, la extensi\u00f3n MPTCP se acaba de adjuntar al skb, por lo que no podemos simplemente eliminar todas las extensiones.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.1.130\",\"matchCriteriaId\":\"5B2819D9-E557-41EC-A77B-F5A5992BBC20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.80\",\"matchCriteriaId\":\"A93F3655-6FAF-43B0-8541-A212998F05B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.17\",\"matchCriteriaId\":\"15370AEE-6D1C-49C3-8CB7-E889D5F92B6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.5\",\"matchCriteriaId\":\"72E69ABB-9015-43A6-87E1-5150383CFFD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/69cafd9413084cd5012cf5d7c7ec6f3d493726d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/87858bbf21da239ace300d61dd209907995c0491\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b6412e6979f6f9e0632075f8f008937b5cd4efd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd34a07f744451e2ecf9005bb7d24d0b2fb83656\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1d5e6a5e468308af7759cf5276779d3155c5e98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.