CVE-2025-21759

A flaw was found in the Linux kernel. A local attacker could trigger a Denial of Service (DoS) or potentially escalate privileges due to a race condition in the IPv6 multicast implementation. In particular, the igmp6_send function can execute without holding required synchronization locks, leading to unsafe access to network data structures. This issue can result in a use-after-free condition, where the system accesses memory after it has been released and causes a system crash.

The patch extends RCU protection in igmp6_send() to prevent a potential use-after-free (UAF) when accessing net->ipv6.igmp_sk. This function could be invoked without holding RTNL or RCU, making concurrent access unsafe in network namespace contexts. The fix replaces sock_alloc_send_skb() with alloc_skb() and sets the owner under RCU to ensure safe allocation. The bug actual only if IPV6 being used and IGMPv6 (Internet Group Management Protocol for IPv6) being used too. The security impact is limited, because no known way to trigger the bug (see in the patch description: "Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF").

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.