{"id":"CVE-2025-21683","state":"PUBLISHED","title":"bpf: Fix bpf_sk_select_reuseport() memory leak","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix bpf_sk_select_reuseport() memory leak\n\nAs pointed out in the original comment, lookup in sockmap can return a TCP\nESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_EBPF\nset before it was ESTABLISHED. In other words, a non-NULL sk_reuseport_cb\ndoes not imply a non-refcounted socket.\n\nDrop sk's reference in both error paths.\n\nunreferenced object 0xffff888101911800 (size 2048):\n  comm \"test_progs\", pid 44109, jiffies 4297131437\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    80 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc 9336483b):\n    __kmalloc_noprof+0x3bf/0x560\n    __reuseport_alloc+0x1d/0x40\n    reuseport_alloc+0xca/0x150\n    reuseport_attach_prog+0x87/0x140\n    sk_reuseport_attach_bpf+0xc8/0x100\n    sk_setsockopt+0x1181/0x1990\n    do_sock_setsockopt+0x12b/0x160\n    __sys_setsockopt+0x7b/0xc0\n    __x64_sys_setsockopt+0x1b/0x30\n    do_syscall_64+0x93/0x180\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e","publishedAt":"2025-01-31T11:25:42.903Z","updatedAt":"2026-10-15T01:03:01.511Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"bb36838dac7bb334a3f3d7eb29875593ec9473fc","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"0ab52a8ca6e156a64c51b5e7456cac9a0ebfd9bf","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"d0a3b3d1176d39218b8edb2a2d03164942ab9ccd","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"b02e70be498b138e9c21701c2f33f4018ca7cd5e","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"cccd51dd22574216e64e5d205489e634f86999f3","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"b3af60928ab9129befa65e6df0310d27300942bf","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/filter.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"5.10.234","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.177","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.127","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.74","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.11","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/filter.c"]}],"references":["https://git.kernel.org/stable/c/bb36838dac7bb334a3f3d7eb29875593ec9473fc","https://git.kernel.org/stable/c/0ab52a8ca6e156a64c51b5e7456cac9a0ebfd9bf","https://git.kernel.org/stable/c/d0a3b3d1176d39218b8edb2a2d03164942ab9ccd","https://git.kernel.org/stable/c/b02e70be498b138e9c21701c2f33f4018ca7cd5e","https://git.kernel.org/stable/c/cccd51dd22574216e64e5d205489e634f86999f3","https://git.kernel.org/stable/c/b3af60928ab9129befa65e6df0310d27300942bf","https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"weaknesses":["CWE-401"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/21xxx/CVE-2025-21683.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21683","state":"PUBLISHED","datePublished":"2025-01-31T11:25:42.903Z","dateUpdated":"2026-10-15T01:03:01.511Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-29T08:45:45.739Z"},"containers":{"cna":{"title":"bpf: Fix bpf_sk_select_reuseport() memory leak","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix bpf_sk_select_reuseport() memory leak\n\nAs pointed out in the original comment, lookup in sockmap can return a TCP\nESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_EBPF\nset before it was ESTABLISHED. In other words, a non-NULL sk_reuseport_cb\ndoes not imply a non-refcounted socket.\n\nDrop sk's reference in both error paths.\n\nunreferenced object 0xffff888101911800 (size 2048):\n  comm \"test_progs\", pid 44109, jiffies 4297131437\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    80 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc 9336483b):\n    __kmalloc_noprof+0x3bf/0x560\n    __reuseport_alloc+0x1d/0x40\n    reuseport_alloc+0xca/0x150\n    reuseport_attach_prog+0x87/0x140\n    sk_reuseport_attach_bpf+0xc8/0x100\n    sk_setsockopt+0x1181/0x1990\n    do_sock_setsockopt+0x12b/0x160\n    __sys_setsockopt+0x7b/0xc0\n    __x64_sys_setsockopt+0x1b/0x30\n    do_syscall_64+0x93/0x180\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"bb36838dac7bb334a3f3d7eb29875593ec9473fc","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"0ab52a8ca6e156a64c51b5e7456cac9a0ebfd9bf","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"d0a3b3d1176d39218b8edb2a2d03164942ab9ccd","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"b02e70be498b138e9c21701c2f33f4018ca7cd5e","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"cccd51dd22574216e64e5d205489e634f86999f3","versionType":"git"},{"version":"64d85290d79c0677edb5a8ee2295b36c022fa5df","status":"affected","lessThan":"b3af60928ab9129befa65e6df0310d27300942bf","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/filter.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"5.10.234","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.177","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.127","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.74","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.11","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/filter.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/bb36838dac7bb334a3f3d7eb29875593ec9473fc"},{"url":"https://git.kernel.org/stable/c/0ab52a8ca6e156a64c51b5e7456cac9a0ebfd9bf"},{"url":"https://git.kernel.org/stable/c/d0a3b3d1176d39218b8edb2a2d03164942ab9ccd"},{"url":"https://git.kernel.org/stable/c/b02e70be498b138e9c21701c2f33f4018ca7cd5e"},{"url":"https://git.kernel.org/stable/c/cccd51dd22574216e64e5d205489e634f86999f3"},{"url":"https://git.kernel.org/stable/c/b3af60928ab9129befa65e6df0310d27300942bf"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:04:25.699Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.10.234"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.15.177"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.1.127"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.6.74"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.12.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-21683","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T19:51:47.465503Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-401","lang":"en","type":"CWE","description":"CWE-401 Missing Release of Memory after Effective Lifetime"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T19:57:11.105Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:59:02.244Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:03:01.511Z"},"x_adpType":"supplier"}]}}}