VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Feb 27, 2025· Updated May 12, 2026

CVE-2025-21758

CVE-2025-21758

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: add RCU protection to mld_newpack()

mld_newpack() can be called without RTNL or RCU being held.

Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.

Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing RCU lock in the Linux kernel's IPv6 MLD code can cause a use-after-free when allocating multicast packets.

Root

Cause

The function mld_newpack() in the Linux kernel's IPv6 multicast listener discovery (MLD) code could be called without holding the RCU read lock or RTNL lock. Because it relied on sock_alloc_send_skb() — which assumes the socket lock is held — the allocation could race with socket destruction, leading to a use-after-free condition [1][3].

Attack

Surface

An attacker would need to be able to trigger MLD packet generation on a system running an affected kernel version. On a typical Linux host, this is possible from unprivileged user space by joining an IPv6 multicast group via a socket. The call path may not hold the necessary locks, so a concurrent socket close or namespace teardown could free the igmp_sk socket while mld_newpack() is still referencing it [2].

Impact

A successful exploit could result in a kernel use-after-free, which typically leads to a denial of service (system crash or kernel panic) and, in theory, could be leveraged for local privilege escalation if the attacker can control the freed memory. The CVSS v3 score of 5.5 (Medium) reflects this local, low-complexity vector [1][4].

Mitigation

The fix replaces sock_alloc_send_skb() with alloc_skb() and charges the socket memory under proper RCU protection, ensuring the socket remains valid during allocation. The patch has been merged into the upstream Linux kernel and is included in stable releases. Users should update to a kernel containing the commit 29fa42197f26 or later [2][3][4].

References
  1. SSA-082556
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

94

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.