{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21864", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.780Z", "datePublished": "2025-03-12T09:42:21.223Z", "dateUpdated": "2026-08-05T11:54:58.229Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:58.229Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: drop secpath at the same time as we currently drop dst\n\nXiumei reported hitting the WARN in xfrm6_tunnel_net_exit while\nrunning tests that boil down to:\n - create a pair of netns\n - run a basic TCP test over ipcomp6\n - delete the pair of netns\n\nThe xfrm_state found on spi_byaddr was not deleted at the time we\ndelete the netns, because we still have a reference on it. This\nlingering reference comes from a secpath (which holds a ref on the\nxfrm_state), which is still attached to an skb. This skb is not\nleaked, it ends up on sk_receive_queue and then gets defer-free'd by\nskb_attempt_defer_free.\n\nThe problem happens when we defer freeing an skb (push it on one CPU's\ndefer_list), and don't flush that list before the netns is deleted. In\nthat case, we still have a reference on the xfrm_state that we don't\nexpect at this point.\n\nWe already drop the skb's dst in the TCP receive path when it's no\nlonger needed, so let's also drop the secpath. At this point,\ntcp_filter has already called into the LSM hooks that may require the\nsecpath, so it should not be needed anymore. However, in some of those\nplaces, the MPTCP extension has just been attached to the skb, so we\ncannot simply drop all extensions." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The trigger requires local operations — creating a network namespace, configuring xfrm/IPComp SAs via XFRM netlink, and deleting the namespace — none of which a remote peer can perform. Although the vulnerable code is in the TCP receive path, a remote party cannot drive the netns teardown that turns the retained secpath reference into memory corruption.\nAC:L - The attacker controls every element of the timing window: which CPU receives the IPsec packet versus which CPU runs recvmsg (forcing skb_attempt_defer_free deferral), whether the target CPU stays idle so the defer_list is not flushed, and exactly when the netns is destroyed, with unlimited retries. IPComp/IPsec is enabled in all mainstream distro kernels, so no rare configuration is needed.\nPR:L - XFRM state creation is gated by netlink_net_capable(CAP_NET_ADMIN), which is ns_capable() against the netns's own user_ns, so an unprivileged user obtains it via `unshare -Urn`; netns creation and destruction are likewise available to unprivileged users through user namespaces. No real root in the initial namespace is required.\nUI:N - The attacker performs the entire sequence — netns creation, IPsec setup, TCP transfer, netns teardown — from their own process with no action by any other user or administrator.\nS:U - The dangling xfrm_state, the freed struct net, and the freed pernet xfrm6_tunnel_net all live within the kernel's own security authority. No hypervisor, IOMMU, or other authority boundary is crossed.\nC:H - The destructor dereferences a freed struct net and a freed pernet xfrm6_tunnel_net, reading net->gen, ng->ptr[id], and then walking an hlist whose contents are attacker-controllable via heap spray of the reclaimed slab objects, yielding an arbitrary kernel-memory read primitive.\nI:H - xfrm6_tunnel_free_spi() performs hlist_del_rcu() (`*pprev = next`), refcount_dec_and_test(), and call_rcu()/kmem_cache_free() on pointers loaded from the freed, sprayable pernet structure, giving a controlled arbitrary-write and arbitrary-free primitive exploitable for control-flow hijacking.\nA:H - The immediate observed symptom is a WARN_ON_ONCE splat in xfrm6_tunnel_net_exit() during netns teardown, which is a hard kernel panic on the many deployments running panic_on_warn; the subsequent use-after-free on the freed netns reliably causes oopses and panics regardless." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/tcp.h", "net/ipv4/tcp_fastopen.c", "net/ipv4/tcp_input.c", "net/ipv4/tcp_ipv4.c" ], "versions": [ { "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086", "lessThan": "87858bbf21da239ace300d61dd209907995c0491", "status": "affected", "versionType": "git" }, { "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086", "lessThan": "f1d5e6a5e468308af7759cf5276779d3155c5e98", "status": "affected", "versionType": "git" }, { "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086", "lessThan": "cd34a07f744451e2ecf9005bb7d24d0b2fb83656", "status": "affected", "versionType": "git" }, { "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086", "lessThan": "69cafd9413084cd5012cf5d7c7ec6f3d493726d9", "status": "affected", "versionType": "git" }, { "version": "68822bdf76f10c3dc80609d4e2cdc1e847429086", "lessThan": "9b6412e6979f6f9e0632075f8f008937b5cd4efd", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/tcp.h", "net/ipv4/tcp_fastopen.c", "net/ipv4/tcp_input.c", "net/ipv4/tcp_ipv4.c" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.130", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.80", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.17", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.5", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.130" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.80" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.17" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.13.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/87858bbf21da239ace300d61dd209907995c0491" }, { "url": "https://git.kernel.org/stable/c/f1d5e6a5e468308af7759cf5276779d3155c5e98" }, { "url": "https://git.kernel.org/stable/c/cd34a07f744451e2ecf9005bb7d24d0b2fb83656" }, { "url": "https://git.kernel.org/stable/c/69cafd9413084cd5012cf5d7c7ec6f3d493726d9" }, { "url": "https://git.kernel.org/stable/c/9b6412e6979f6f9e0632075f8f008937b5cd4efd" } ], "title": "tcp: drop secpath at the same time as we currently drop dst", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-21864", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T19:25:34.148914Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:26:37.158Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:38:20.615Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:40:21.421Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ] } ] } }