-
CVE-2025-68245
- EPSS 0.06%
- Veröffentlicht 16.12.2025 14:21:22
- Zuletzt bearbeitet 18.12.2025 15:08:06
- Quelle 416baaa9-dc9f-4396-8d5f-8c081f
- CVE-Watchlists
- Unerledigt
In the Linux kernel, the following vulnerability has been resolved:
net: netpoll: fix incorrect refcount handling causing incorrect cleanup
commit efa95b01da18 ("netpoll: fix use after free") incorrectly
ignored the refcount and prematurely set dev->npinfo to NULL during
netpoll cleanup, leading to improper behavior and memory leaks.
Scenario causing lack of proper cleanup:
1) A netpoll is associated with a NIC (e.g., eth0) and netdev->npinfo is
allocated, and refcnt = 1
- Keep in mind that npinfo is shared among all netpoll instances. In
this case, there is just one.
2) Another netpoll is also associated with the same NIC and
npinfo->refcnt += 1.
- Now dev->npinfo->refcnt = 2;
- There is just one npinfo associated to the netdev.
3) When the first netpolls goes to clean up:
- The first cleanup succeeds and clears np->dev->npinfo, ignoring
refcnt.
- It basically calls `RCU_INIT_POINTER(np->dev->npinfo, NULL);`
- Set dev->npinfo = NULL, without proper cleanup
- No ->ndo_netpoll_cleanup() is either called
4) Now the second target tries to clean up
- The second cleanup fails because np->dev->npinfo is already NULL.
* In this case, ops->ndo_netpoll_cleanup() was never called, and
the skb pool is not cleaned as well (for the second netpoll
instance)
- This leaks npinfo and skbpool skbs, which is clearly reported by
kmemleak.
Revert commit efa95b01da18 ("netpoll: fix use after free") and adds
clarifying comments emphasizing that npinfo cleanup should only happen
once the refcount reaches zero, ensuring stable and correct netpoll
behavior.Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt
Linux
Default Statusunaffected
Version <
8e6a50edad11e3e1426e4c29e7aa6201f3468ac2
Version
efa95b01da18ad22af62f6d99a3243f3be8fd264
Status
affected
Version <
9b0bb18b4b9dc017c1825a2c5e763615e34a1593
Version
efa95b01da18ad22af62f6d99a3243f3be8fd264
Status
affected
Version <
890472d6fbf062e6de7fdd56642cb305ab79d669
Version
efa95b01da18ad22af62f6d99a3243f3be8fd264
Status
affected
Version <
4afd4ebbad52aa146838ec23082ba393e426a2bb
Version
efa95b01da18ad22af62f6d99a3243f3be8fd264
Status
affected
Version <
c645693180a98606c430825223d2029315d85e9d
Version
efa95b01da18ad22af62f6d99a3243f3be8fd264
Status
affected
Version <
c79a6d9da29219616b118a3adce9a14cd30f9bd0
Version
efa95b01da18ad22af62f6d99a3243f3be8fd264
Status
affected
Version <
9a51b5ccd1c79afec1c03a4e1e6688da52597556
Version
efa95b01da18ad22af62f6d99a3243f3be8fd264
Status
affected
Version <
49c8d2c1f94cc2f4d1a108530d7ba52614b874c2
Version
efa95b01da18ad22af62f6d99a3243f3be8fd264
Status
affected
HerstellerLinux
≫
Produkt
Linux
Default Statusaffected
Version
3.17
Status
affected
Version <
3.17
Version
0
Status
unaffected
Version <=
5.4.*
Version
5.4.302
Status
unaffected
Version <=
5.10.*
Version
5.10.247
Status
unaffected
Version <=
5.15.*
Version
5.15.197
Status
unaffected
Version <=
6.1.*
Version
6.1.159
Status
unaffected
Version <=
6.6.*
Version
6.6.117
Status
unaffected
Version <=
6.12.*
Version
6.12.59
Status
unaffected
Version <=
6.17.*
Version
6.17.9
Status
unaffected
Version <=
*
Version
6.18
Status
unaffected
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.06% | 0.191 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|