7.8

CVE-2025-21759

ipv6: mcast: extend RCU protection in igmp6_send()

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: extend RCU protection in igmp6_send()

igmp6_send() can be called without RTNL or RCU being held.

Extend RCU protection so that we can safely fetch the net pointer
and avoid a potential UAF.

Note that we no longer can use sock_alloc_send_skb() because
ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.

Instead use alloc_skb() and charge the net->ipv6.igmp_sk
socket under RCU protection.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.26 < 6.6.79
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.16
Linux ≫ Linux Kernel Version >= 6.13 < 6.13.4
Linux ≫ Linux Kernel Version 6.14 Update rc1
Linux ≫ Linux Kernel Version 6.14 Update rc2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.37% 0.939
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/087c1faa594fa07a66933d750c0b2610aa1a2946
Patch
https://git.kernel.org/stable/c/0bf8e2f3768629d437a32cb824149e6e98254381
Patch
https://git.kernel.org/stable/c/81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a
Patch
https://git.kernel.org/stable/c/8e92d6a413feaf968a33f0b439ecf27404407458
Patch
https://git.kernel.org/stable/c/638e8fe3563a82f298fe537a28d5342a97278cf1
https://git.kernel.org/stable/c/6901bbb169e3add6c037218d996790cef6b3d650
https://git.kernel.org/stable/c/7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff