Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-21972

net: mctp: unshare packets when reassembling

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: mctp: unshare packets when reassembling Ensure that the frag_list used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and prevents a memory leak due to circular references between fragments and their skb_shared_info. The upcoming MCTP-over-USB driver uses skb_clone which can trigger the problem - other MCTP drivers don't share SKBs. A kunit test is added to reproduce the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 4a992bbd365094730a31bae1e12a6ca695336d57 to < 3d0281d0713952e8dd14d6d47e3a9c345c28a3b7affected
  • 4a992bbd365094730a31bae1e12a6ca695336d57 to < 5c47d5bfa7b096cf8890afac32141c578583f8e0affected
  • 4a992bbd365094730a31bae1e12a6ca695336d57 to < f44fff3d3c6cd67b6f348b821d73c4d6888c7a6eaffected
  • 4a992bbd365094730a31bae1e12a6ca695336d57 to < f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeeccaffected

Linux Linux

Default version status: affected

  • 5.15affected
  • 0 to < 5.15unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.20 to ≤ 6.12.*unaffected
  • 6.13.8 to ≤ 6.13.*unaffected
  • 6.14 to ≤ *unaffected

References