CVE-2025-21972

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: unshare packets when reassembling

Ensure that the frag_list used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and prevents a memory leak due to circular references between fragments and their skb_shared_info.

The upcoming MCTP-over-USB driver uses skb_clone which can trigger the problem - other MCTP drivers don't share SKBs.

A kunit test is added to reproduce the issue.

Red Hat Enterprise Linux kernel packages are not vulnerable to this issue because the affected Management Component Transport Protocol (MCTP) implementation is not present in supported releases. In upstream environments, this flaw poses an availability risk resulting from improper handling of cloned network packet buffers during reassembly, potentially causing memory leaks or corrupted reassembly. Enterprise deployments do not ship the vulnerable subsystem, meaning standard server configurations remain unaffected.