CVE-2025-21758 ipv6: mcast: add RCU protection to mld_newpack()
A race condition in the Linux kernel IPv6 multicast code can lead to a denial of service due to missing RCU protection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21758?
CVE-2025-21758 is a high-severity vulnerability in Linux kernel, published on 27 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: add RCU protection to mld_newpack()
mld_newpack() can be called without RTNL or RCU being held.
Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.
Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection.
Which versions are affected by CVE-2025-21758?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21758?
Apply the vendor's patch.
Is CVE-2025-21758 being exploited?
There is no known exploitation of CVE-2025-21758 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21758, DEBIAN-CVE-2025-21758, GHSA-xv46-47mw-9vxc, ROOT-OS-DEBIAN-11-CVE-2025-21758, ROOT-OS-UBUNTU-2404-CVE-2025-21758, UBUNTU-CVE-2025-21758.