{"id":"CVE-2025-21759","state":"PUBLISHED","title":"ipv6: mcast: extend RCU protection in igmp6_send()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: extend RCU protection in igmp6_send()\n\nigmp6_send() can be called without RTNL or RCU being held.\n\nExtend RCU protection so that we can safely fetch the net pointer\nand avoid a potential UAF.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net->ipv6.igmp_sk\nsocket under RCU protection.","publishedAt":"2025-02-27T02:18:12.994Z","updatedAt":"2026-10-03T10:55:25.159Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"638e8fe3563a82f298fe537a28d5342a97278cf1","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"6901bbb169e3add6c037218d996790cef6b3d650","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"0bf8e2f3768629d437a32cb824149e6e98254381","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"8e92d6a413feaf968a33f0b439ecf27404407458","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"087c1faa594fa07a66933d750c0b2610aa1a2946","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/mcast.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.26","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.26","versionType":"semver"},{"version":"5.10.271","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.222","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.79","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.16","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.4","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/mcast.c"]}],"references":["https://git.kernel.org/stable/c/638e8fe3563a82f298fe537a28d5342a97278cf1","https://git.kernel.org/stable/c/6901bbb169e3add6c037218d996790cef6b3d650","https://git.kernel.org/stable/c/7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff","https://git.kernel.org/stable/c/81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a","https://git.kernel.org/stable/c/0bf8e2f3768629d437a32cb824149e6e98254381","https://git.kernel.org/stable/c/8e92d6a413feaf968a33f0b439ecf27404407458","https://git.kernel.org/stable/c/087c1faa594fa07a66933d750c0b2610aa1a2946"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/21xxx/CVE-2025-21759.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21759","state":"PUBLISHED","datePublished":"2025-02-27T02:18:12.994Z","dateUpdated":"2026-10-03T10:55:25.159Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-29T08:45:45.761Z"},"containers":{"cna":{"title":"ipv6: mcast: extend RCU protection in igmp6_send()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: extend RCU protection in igmp6_send()\n\nigmp6_send() can be called without RTNL or RCU being held.\n\nExtend RCU protection so that we can safely fetch the net pointer\nand avoid a potential UAF.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net->ipv6.igmp_sk\nsocket under RCU protection."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"638e8fe3563a82f298fe537a28d5342a97278cf1","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"6901bbb169e3add6c037218d996790cef6b3d650","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"0bf8e2f3768629d437a32cb824149e6e98254381","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"8e92d6a413feaf968a33f0b439ecf27404407458","versionType":"git"},{"version":"b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551","status":"affected","lessThan":"087c1faa594fa07a66933d750c0b2610aa1a2946","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/mcast.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.26","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.26","versionType":"semver"},{"version":"5.10.271","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.222","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.79","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.16","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.4","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/mcast.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/638e8fe3563a82f298fe537a28d5342a97278cf1"},{"url":"https://git.kernel.org/stable/c/6901bbb169e3add6c037218d996790cef6b3d650"},{"url":"https://git.kernel.org/stable/c/7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff"},{"url":"https://git.kernel.org/stable/c/81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a"},{"url":"https://git.kernel.org/stable/c/0bf8e2f3768629d437a32cb824149e6e98254381"},{"url":"https://git.kernel.org/stable/c/8e92d6a413feaf968a33f0b439ecf27404407458"},{"url":"https://git.kernel.org/stable/c/087c1faa594fa07a66933d750c0b2610aa1a2946"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Although igmp6_send() can be scheduled by adjacent MLD Query packets, the freeing side of the race requires network-namespace dismantle or a netdev netns move, which is driven by local syscalls (unshare/setns, RTM_NEWLINK with IFLA_NET_NS_FD, process exit). A local unprivileged user controls both sides of the race entirely, making local access the reliable exploitation vector.\nAC:L - The attacker drives both halves: they schedule igmp6_send() at will (multicast join/leave, link up/down, or timed MLD reports) and trigger the free by destroying their own netns or moving the device out of it, and can retry the race indefinitely while heap-grooming the freed struct net/struct sock.\nPR:L - Only an unprivileged local account is needed — the CAP_NET_ADMIN checks on the netns-move path are ns_capable() against the target netns user_ns, which is satisfied inside a user namespace created with unshare -Urn, and IPv6 multicast joins require no privilege at all.\nUI:N - The entire sequence — namespace setup, multicast group joins, and namespace teardown — is performed by the attacker's own processes with no action from any other user.\nS:U - The corrupted objects (struct net, struct sock) and the resulting code execution are all within the kernel's own security authority; no hypervisor, IOMMU, or other security boundary is crossed.\nC:H - The use-after-free reads sk->sk_sndbuf, sk->sk_allocation, sk->sk_socket, net->mib pointers and net->nf.hooks_ipv6[] from freed-and-reallocated memory, giving an attacker who sprays the freed slab a controllable pointer-dereference primitive that can be turned into arbitrary kernel memory disclosure.\nI:H - skb_set_owner_w() performs refcount_add() into the freed socket and NF_HOOK() calls a function pointer fetched from the freed struct net's netfilter hook array, yielding both a write primitive and control-flow hijack suitable for full privilege escalation.\nA:H - Dereferencing a freed struct net and its igmp_sk reliably produces a kernel oops/panic (slab-use-after-free, invalid pointer dereference in the netfilter or socket accounting path), and the race can be repeated to crash the machine."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-03T10:55:25.159Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"5.10.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"5.15.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"6.1.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"6.6.79"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"6.12.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"6.13.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.26","versionEndExcluding":"6.14"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-21759","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-27T17:57:46.460072Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-27T18:02:27.454Z"}}]}}}