CVE-2025-21758

MediumCVSS 5.5

Published: 27/02/2025(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

13.04%

96th percentile - higher than 96% of all known CVEs

Summary

In the Linux kernel, the mld_newpack() function lacked RCU protection, potentially causing data races. The fix replaces sock_alloc_send_skb() with alloc_skb() and charges the socket under RCU protection.

Risk Assessment

Missing RCU protection could allow a local attacker to trigger undefined behavior, potentially leading to system crash or privilege escalation.

Recommendation

Immediately update the Linux kernel to a version containing the fix (commit 4c3b8b0e1b9c or later).

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can be called without RTNL or RCU being held. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection.