Zetlyn
GitHubGet started

kernel: ipv6: mcast: extend RCU protection in igmp6_send()

cve CVE-2025-21759 2 sources, 2 claims · Watch

Red Hat writes:
kernel: ipv6: mcast: extend RCU protection in igmp6_send() the claim

What it is to other things

affectslinux/linux_kernel
NVD
made_bylinux
NVD

In words only, so not counted until a person confirms one:

affectslinux/linux
NVD says “Linux · Linux”

What each source says

PropertySourceSaidMeans here
Cvss
cvss
conflict		NVD7.8
receipt
Source
NVD
Its words
7.8
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/ipv6/mcast.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "638e8fe3563a82f298fe537a28d5342a97278cf1",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "6901bbb169e3add6c037218d996790cef6b3d650",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "0bf8e2f3768629d437a32cb824149e6e98254381",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "8e92d6a413feaf968a33f0b439ecf27404407458",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "087c1faa594fa07a66933d750c0b2610aa1a2946",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/ipv6/mcast.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "2.6.26"
              },
              {
                "lessThan": "2.6.26",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.271",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.79",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.16",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.13.*",
                "status": "unaffected",
                "version": "6.13.4",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.14",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "80691BA5-295B-4772-9338-1D31A39548D6",
                "versionEndExcluding": "6.6.79",
                "versionStartIncluding": "2.6.26",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "13C8DB18-FC60-425F-84E5-3EDDEC61B2FC",
                "versionEndExcluding": "6.12.16",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4",
                "versionEndExcluding": "6.13.4",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: extend RCU protection in igmp6_send()\n\nigmp6_send() can be called without RTNL or RCU being held.\n\nExtend RCU protection so that we can safely fetch the net pointer\nand avoid a potential UAF.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net->ipv6.igmp_sk\nsocket under RCU protection."
      },
      {
        "lang": "es",
        "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipv6: mcast: extender la protección RCU en igmp6_send() igmp6_send() se puede llamar sin que se mantenga RTNL o RCU. Extienda la protección RCU para que podamos obtener de forma segura el puntero de red y evitar un posible UAF. Tenga en cuenta que ya no podemos usar sock_alloc_send_skb() porque ipv6.igmp_sk usa asignaciones GFP_KERNEL que pueden dormir. En su lugar, use alloc_skb() y cargue el socket net->ipv6.igmp_sk bajo la protección RCU."
      }
    ],
    "id": "CVE-2025-21759",
    "lastModified": "2026-10-03T11:17:32.400",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-21759",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-02-27T17:57:46.460072Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-02-27T03:15:16.550",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/087c1faa594fa07a66933d750c0b2610aa1a2946"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/0bf8e2f3768629d437a32cb824149e6e98254381"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/638e8fe3563a82f298fe537a28d5342a97278cf1"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/6901bbb169e3add6c037218d996790cef6b3d650"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/8e92d6a413feaf968a33f0b439ecf27404407458"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-416"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}
—
Cvss
cvss
conflict		Red Hat6.6
receipt
Source
Red Hat
Its words
6.6
Read by
field:cvss3_score
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-21759",
  "CWE": "CWE-416",
  "advisories": [
    "RHSA-2025:10379",
    "RHSA-2025:10830",
    "RHSA-2025:13589",
    "RHSA-2025:11245",
    "RHSA-2025:12311",
    "RHSA-2025:10829",
    "RHSA-2025:15656",
    "RHSA-2025:14985",
    "RHSA-2025:12209",
    "RHSA-2025:15660",
    "RHSA-2025:17124",
    "RHSA-2025:10371",
    "RHSA-2025:13590"
  ],
  "affected_packages": [
    "kernel-0:4.18.0-477.108.1.el8_8",
    "kernel-0:4.18.0-305.172.1.el8_4",
    "kernel-0:6.12.0-55.20.1.el10_0",
    "kernel-0:5.14.0-284.128.1.el9_2",
    "kernel-rt-0:5.14.0-284.128.1.rt14.413.el9_2",
    "kernel-0:4.18.0-553.69.1.el8_10",
    "kernel-0:5.14.0-427.77.1.el9_4",
    "kernel-rt-0:4.18.0-553.69.1.rt7.410.el8_10",
    "kernel-rt-0:5.14.0-70.138.1.rt21.210.el9_0",
    "kernel-0:4.18.0-372.162.1.el8_6",
    "kernel-0:4.18.0-193.168.1.el8_2",
    "kernel-0:5.14.0-570.25.1.el9_6",
    "kernel-0:5.14.0-70.138.1.el9_0"
  ],
  "bugzilla": "2348596",
  "bugzilla_description": "kernel: ipv6: mcast: extend RCU protection in igmp6_send()",
  "cvss3_score": "6.6",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-02-27T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-21759.json",
  "severity": "moderate"
}
—
Cwe
cwe
Red HatCWE-416
receipt
Source
Red Hat
Its words
CWE-416
Read by
field:CWE
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-21759",
  "CWE": "CWE-416",
  "advisories": [
    "RHSA-2025:10379",
    "RHSA-2025:10830",
    "RHSA-2025:13589",
    "RHSA-2025:11245",
    "RHSA-2025:12311",
    "RHSA-2025:10829",
    "RHSA-2025:15656",
    "RHSA-2025:14985",
    "RHSA-2025:12209",
    "RHSA-2025:15660",
    "RHSA-2025:17124",
    "RHSA-2025:10371",
    "RHSA-2025:13590"
  ],
  "affected_packages": [
    "kernel-0:4.18.0-477.108.1.el8_8",
    "kernel-0:4.18.0-305.172.1.el8_4",
    "kernel-0:6.12.0-55.20.1.el10_0",
    "kernel-0:5.14.0-284.128.1.el9_2",
    "kernel-rt-0:5.14.0-284.128.1.rt14.413.el9_2",
    "kernel-0:4.18.0-553.69.1.el8_10",
    "kernel-0:5.14.0-427.77.1.el9_4",
    "kernel-rt-0:4.18.0-553.69.1.rt7.410.el8_10",
    "kernel-rt-0:5.14.0-70.138.1.rt21.210.el9_0",
    "kernel-0:4.18.0-372.162.1.el8_6",
    "kernel-0:4.18.0-193.168.1.el8_2",
    "kernel-0:5.14.0-570.25.1.el9_6",
    "kernel-0:5.14.0-70.138.1.el9_0"
  ],
  "bugzilla": "2348596",
  "bugzilla_description": "kernel: ipv6: mcast: extend RCU protection in igmp6_send()",
  "cvss3_score": "6.6",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-02-27T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-21759.json",
  "severity": "moderate"
}
—
Packages
packages
Red Hatkernel-0:4.18.0-477.108.1.el8_8, kernel-0:4.18.0-305.172.1.el8_4, kernel-0:6.12.0-55.20.1.el10_0, kernel-0:5.14.0-284.128.1.el9_2, kernel-rt-0:5.14.0-284.128.1.rt14.413.el9_2, kernel-0:4.18.0-553.69.1.el8_10, kernel-0:5.14.0-427.77.1.el9_4, kernel-rt-0:4.18.0-553.69.1.rt7.410.el8_10, kernel-rt-0:5.14.0-70.138.1.rt21.210.el9_0, kernel-0:4.18.0-372.162.1.el8_6, kernel-0:4.18.0-193.168.1.el8_2, kernel-0:5.14.0-570.25.1.el9_6, kernel-0:5.14.0-70.138.1.el9_0
receipt
Source
Red Hat
Its words
kernel-0:4.18.0-477.108.1.el8_8, kernel-0:4.18.0-305.172.1.el8_4, kernel-0:6.12.0-55.20.1.el10_0, kernel-0:5.14.0-284.128.1.el9_2, kernel-rt-0:5.14.0-284.128.1.rt14.413.el9_2, kernel-0:4.18.0-553.69.1.el8_10, kernel-0:5.14.0-427.77.1.el9_4, kernel-rt-0:4.18.0-553.69.1.rt7.410.el8_10, kernel-rt-0:5.14.0-70.138.1.rt21.210.el9_0, kernel-0:4.18.0-372.162.1.el8_6, kernel-0:4.18.0-193.168.1.el8_2, kernel-0:5.14.0-570.25.1.el9_6, kernel-0:5.14.0-70.138.1.el9_0
Read by
field:affected_packages[]
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-21759",
  "CWE": "CWE-416",
  "advisories": [
    "RHSA-2025:10379",
    "RHSA-2025:10830",
    "RHSA-2025:13589",
    "RHSA-2025:11245",
    "RHSA-2025:12311",
    "RHSA-2025:10829",
    "RHSA-2025:15656",
    "RHSA-2025:14985",
    "RHSA-2025:12209",
    "RHSA-2025:15660",
    "RHSA-2025:17124",
    "RHSA-2025:10371",
    "RHSA-2025:13590"
  ],
  "affected_packages": [
    "kernel-0:4.18.0-477.108.1.el8_8",
    "kernel-0:4.18.0-305.172.1.el8_4",
    "kernel-0:6.12.0-55.20.1.el10_0",
    "kernel-0:5.14.0-284.128.1.el9_2",
    "kernel-rt-0:5.14.0-284.128.1.rt14.413.el9_2",
    "kernel-0:4.18.0-553.69.1.el8_10",
    "kernel-0:5.14.0-427.77.1.el9_4",
    "kernel-rt-0:4.18.0-553.69.1.rt7.410.el8_10",
    "kernel-rt-0:5.14.0-70.138.1.rt21.210.el9_0",
    "kernel-0:4.18.0-372.162.1.el8_6",
    "kernel-0:4.18.0-193.168.1.el8_2",
    "kernel-0:5.14.0-570.25.1.el9_6",
    "kernel-0:5.14.0-70.138.1.el9_0"
  ],
  "bugzilla": "2348596",
  "bugzilla_description": "kernel: ipv6: mcast: extend RCU protection in igmp6_send()",
  "cvss3_score": "6.6",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-02-27T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-21759.json",
  "severity": "moderate"
}
—
Product
product
NVDLinux
receipt
Source
NVD
Its words
Linux
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/ipv6/mcast.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "638e8fe3563a82f298fe537a28d5342a97278cf1",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "6901bbb169e3add6c037218d996790cef6b3d650",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "0bf8e2f3768629d437a32cb824149e6e98254381",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "8e92d6a413feaf968a33f0b439ecf27404407458",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "087c1faa594fa07a66933d750c0b2610aa1a2946",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/ipv6/mcast.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "2.6.26"
              },
              {
                "lessThan": "2.6.26",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.271",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.79",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.16",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.13.*",
                "status": "unaffected",
                "version": "6.13.4",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.14",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "80691BA5-295B-4772-9338-1D31A39548D6",
                "versionEndExcluding": "6.6.79",
                "versionStartIncluding": "2.6.26",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "13C8DB18-FC60-425F-84E5-3EDDEC61B2FC",
                "versionEndExcluding": "6.12.16",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4",
                "versionEndExcluding": "6.13.4",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: extend RCU protection in igmp6_send()\n\nigmp6_send() can be called without RTNL or RCU being held.\n\nExtend RCU protection so that we can safely fetch the net pointer\nand avoid a potential UAF.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net->ipv6.igmp_sk\nsocket under RCU protection."
      },
      {
        "lang": "es",
        "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipv6: mcast: extender la protección RCU en igmp6_send() igmp6_send() se puede llamar sin que se mantenga RTNL o RCU. Extienda la protección RCU para que podamos obtener de forma segura el puntero de red y evitar un posible UAF. Tenga en cuenta que ya no podemos usar sock_alloc_send_skb() porque ipv6.igmp_sk usa asignaciones GFP_KERNEL que pueden dormir. En su lugar, use alloc_skb() y cargue el socket net->ipv6.igmp_sk bajo la protección RCU."
      }
    ],
    "id": "CVE-2025-21759",
    "lastModified": "2026-10-03T11:17:32.400",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-21759",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-02-27T17:57:46.460072Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-02-27T03:15:16.550",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/087c1faa594fa07a66933d750c0b2610aa1a2946"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/0bf8e2f3768629d437a32cb824149e6e98254381"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/638e8fe3563a82f298fe537a28d5342a97278cf1"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/6901bbb169e3add6c037218d996790cef6b3d650"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/8e92d6a413feaf968a33f0b439ecf27404407458"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-416"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
Red Hatmoderate
A flaw that is harder to exploit, or whose impact is limited.
receipt
Source
Red Hat
Its words
moderate
Read by
field:severity
Said since
2026-09-29 09:44 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "CVE": "CVE-2025-21759",
  "CWE": "CWE-416",
  "advisories": [
    "RHSA-2025:10379",
    "RHSA-2025:10830",
    "RHSA-2025:13589",
    "RHSA-2025:11245",
    "RHSA-2025:12311",
    "RHSA-2025:10829",
    "RHSA-2025:15656",
    "RHSA-2025:14985",
    "RHSA-2025:12209",
    "RHSA-2025:15660",
    "RHSA-2025:17124",
    "RHSA-2025:10371",
    "RHSA-2025:13590"
  ],
  "affected_packages": [
    "kernel-0:4.18.0-477.108.1.el8_8",
    "kernel-0:4.18.0-305.172.1.el8_4",
    "kernel-0:6.12.0-55.20.1.el10_0",
    "kernel-0:5.14.0-284.128.1.el9_2",
    "kernel-rt-0:5.14.0-284.128.1.rt14.413.el9_2",
    "kernel-0:4.18.0-553.69.1.el8_10",
    "kernel-0:5.14.0-427.77.1.el9_4",
    "kernel-rt-0:4.18.0-553.69.1.rt7.410.el8_10",
    "kernel-rt-0:5.14.0-70.138.1.rt21.210.el9_0",
    "kernel-0:4.18.0-372.162.1.el8_6",
    "kernel-0:4.18.0-193.168.1.el8_2",
    "kernel-0:5.14.0-570.25.1.el9_6",
    "kernel-0:5.14.0-70.138.1.el9_0"
  ],
  "bugzilla": "2348596",
  "bugzilla_description": "kernel: ipv6: mcast: extend RCU protection in igmp6_send()",
  "cvss3_score": "6.6",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2025-02-27T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-21759.json",
  "severity": "moderate"
}
medium
Status
status
NVDModified
receipt
Source
NVD
Its words
Modified
Read by
field:cve.vulnStatus
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/ipv6/mcast.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "638e8fe3563a82f298fe537a28d5342a97278cf1",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "6901bbb169e3add6c037218d996790cef6b3d650",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "0bf8e2f3768629d437a32cb824149e6e98254381",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "8e92d6a413feaf968a33f0b439ecf27404407458",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "087c1faa594fa07a66933d750c0b2610aa1a2946",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/ipv6/mcast.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "2.6.26"
              },
              {
                "lessThan": "2.6.26",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.271",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.79",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.16",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.13.*",
                "status": "unaffected",
                "version": "6.13.4",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.14",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "80691BA5-295B-4772-9338-1D31A39548D6",
                "versionEndExcluding": "6.6.79",
                "versionStartIncluding": "2.6.26",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "13C8DB18-FC60-425F-84E5-3EDDEC61B2FC",
                "versionEndExcluding": "6.12.16",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4",
                "versionEndExcluding": "6.13.4",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: extend RCU protection in igmp6_send()\n\nigmp6_send() can be called without RTNL or RCU being held.\n\nExtend RCU protection so that we can safely fetch the net pointer\nand avoid a potential UAF.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net->ipv6.igmp_sk\nsocket under RCU protection."
      },
      {
        "lang": "es",
        "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipv6: mcast: extender la protección RCU en igmp6_send() igmp6_send() se puede llamar sin que se mantenga RTNL o RCU. Extienda la protección RCU para que podamos obtener de forma segura el puntero de red y evitar un posible UAF. Tenga en cuenta que ya no podemos usar sock_alloc_send_skb() porque ipv6.igmp_sk usa asignaciones GFP_KERNEL que pueden dormir. En su lugar, use alloc_skb() y cargue el socket net->ipv6.igmp_sk bajo la protección RCU."
      }
    ],
    "id": "CVE-2025-21759",
    "lastModified": "2026-10-03T11:17:32.400",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-21759",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-02-27T17:57:46.460072Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-02-27T03:15:16.550",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/087c1faa594fa07a66933d750c0b2610aa1a2946"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/0bf8e2f3768629d437a32cb824149e6e98254381"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/638e8fe3563a82f298fe537a28d5342a97278cf1"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/6901bbb169e3add6c037218d996790cef6b3d650"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/8e92d6a413feaf968a33f0b439ecf27404407458"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-416"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDLinux
receipt
Source
NVD
Its words
Linux
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-05 12:24 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/ipv6/mcast.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "638e8fe3563a82f298fe537a28d5342a97278cf1",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "6901bbb169e3add6c037218d996790cef6b3d650",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "0bf8e2f3768629d437a32cb824149e6e98254381",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "8e92d6a413feaf968a33f0b439ecf27404407458",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              },
              {
                "lessThan": "087c1faa594fa07a66933d750c0b2610aa1a2946",
                "status": "affected",
                "version": "b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/ipv6/mcast.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "2.6.26"
              },
              {
                "lessThan": "2.6.26",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.271",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.79",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.16",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.13.*",
                "status": "unaffected",
                "version": "6.13.4",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.14",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "80691BA5-295B-4772-9338-1D31A39548D6",
                "versionEndExcluding": "6.6.79",
                "versionStartIncluding": "2.6.26",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "13C8DB18-FC60-425F-84E5-3EDDEC61B2FC",
                "versionEndExcluding": "6.12.16",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4",
                "versionEndExcluding": "6.13.4",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: extend RCU protection in igmp6_send()\n\nigmp6_send() can be called without RTNL or RCU being held.\n\nExtend RCU protection so that we can safely fetch the net pointer\nand avoid a potential UAF.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net->ipv6.igmp_sk\nsocket under RCU protection."
      },
      {
        "lang": "es",
        "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipv6: mcast: extender la protección RCU en igmp6_send() igmp6_send() se puede llamar sin que se mantenga RTNL o RCU. Extienda la protección RCU para que podamos obtener de forma segura el puntero de red y evitar un posible UAF. Tenga en cuenta que ya no podemos usar sock_alloc_send_skb() porque ipv6.igmp_sk usa asignaciones GFP_KERNEL que pueden dormir. En su lugar, use alloc_skb() y cargue el socket net->ipv6.igmp_sk bajo la protección RCU."
      }
    ],
    "id": "CVE-2025-21759",
    "lastModified": "2026-10-03T11:17:32.400",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-21759",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-02-27T17:57:46.460072Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-02-27T03:15:16.550",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/087c1faa594fa07a66933d750c0b2610aa1a2946"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/0bf8e2f3768629d437a32cb824149e6e98254381"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/638e8fe3563a82f298fe537a28d5342a97278cf1"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/6901bbb169e3add6c037218d996790cef6b3d650"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/7e0a818ecc4d62e7fb668ea02de0bfe8ba0b7dff"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/8e92d6a413feaf968a33f0b439ecf27404407458"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-416"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}
—

vulnerability

kernel: ipv6: mcast: extend RCU protection in igmp6_send()
zetlyn/cve-redhat · 2025-02-27
cvss 6.6 cwe CWE-416 packages kernel-0:4.18.0-477.108.1.el8_8, kernel-0:4.18.0-305.172.1.el8_4, kernel-0:6.12.0-55.20.1.el10_0, kernel-0:5.14.0-284.128.1.el9_2, kernel-rt-0:5.14.0-284.128.1.rt14.413.el9_2, kernel-0:4.18.0-553.69.1.el8_10, kernel-0:5.14.0-427.77.1.el9_4, kernel-rt-0:4.18.0-553.69.1.rt7.410.el8_10, kernel-rt-0:5.14.0-70.138.1.rt21.210.el9_0, kernel-0:4.18.0-372.162.1.el8_6, kernel-0:4.18.0-193.168.1.el8_2, kernel-0:5.14.0-570.25.1.el9_6, kernel-0:5.14.0-70.138.1.el9_0 severity moderate source
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection.
zetlyn/cve-nvd · 2025-02-27
cvss 7.8 product Linux status Modified vendor Linux source