← back
CVE-2025-21758

ipv6: mcast: add RCU protection to mld_newpack()

EPSS 13.6%
In short

A race condition in Linux kernel's IPv6 multicast code where mld_newpack() function could be called without proper synchronization protection, potentially causing memory corruption or crashes when multiple threads access it simultaneously.

Technical detail

The mld_newpack() function in IPv6 multicast handling lacked RCU (Read-Copy-Update) protection when allocating socket buffers, creating a race condition when concurrent calls occurred without RTNL lock. The fix implements RCU protection for socket charging and replaces sock_alloc_send_skb() with alloc_skb() to avoid blocking operations, preventing data structure inconsistency and potential kernel panic.

Summary generated and translated by AI from the official description.
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can be called without RTNL or RCU being held. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection.
Affected products
Linux · Linux

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →