CVE-2025-21768

Some lwtunnels have a dst cache for post-transformation dst. If the packet destination did not change we may end up recording a reference to the lwtunnel in its own cache, and the lwtunnel state will never be freed.

Discovered by the ioam6.sh test, kmemleak was recently fixed to catch per-cpu memory leaks. I'm not sure if rpl and seg6 can actually hit this, but in principle I don't see why not.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6c8702c60b88651072460f3f4026c7dfe2521d12

Fixed

5ab11a4e219e93b8b31a27f8ec98d42afadd8b7a

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6c8702c60b88651072460f3f4026c7dfe2521d12

Fixed

4c0f200c7d06fedddde82209c099014d63f4a6c0

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6c8702c60b88651072460f3f4026c7dfe2521d12

Fixed

92191dd1073088753821b862b791dcc83e558e07

Affected versions

v4.*

v4.10

v4.10-rc1

v4.10-rc2

v4.10-rc3

v4.10-rc4

v4.10-rc5

v4.10-rc6

v4.10-rc7

v4.10-rc8

v4.11

v4.11-rc1

v4.11-rc2

v4.11-rc3

v4.11-rc4

v4.11-rc5

v4.11-rc6

v4.11-rc7

v4.11-rc8

v4.12

v4.12-rc1

v4.12-rc2

v4.12-rc3

v4.12-rc4

v4.12-rc5

v4.12-rc6

v4.12-rc7

v4.13

v4.13-rc1

v4.13-rc2

v4.13-rc3

v4.13-rc4

v4.13-rc5

v4.13-rc6

v4.13-rc7

v4.14

v4.14-rc1

v4.14-rc2

v4.14-rc3

v4.14-rc4

v4.14-rc5

v4.14-rc6

v4.14-rc7

v4.14-rc8

v4.15

v4.15-rc1

v4.15-rc2

v4.15-rc3

v4.15-rc4

v4.15-rc5

v4.15-rc6

v4.15-rc7

v4.15-rc8

v4.15-rc9

v4.16

v4.16-rc1

v4.16-rc2

v4.16-rc3

v4.16-rc4

v4.16-rc5

v4.16-rc6

v4.16-rc7

v4.17

v4.17-rc1

v4.17-rc2

v4.17-rc3

v4.17-rc4

v4.17-rc5

v4.17-rc6

v4.17-rc7

v4.18

v4.18-rc1

v4.18-rc2

v4.18-rc3

v4.18-rc4

v4.18-rc5

v4.18-rc6

v4.18-rc7

v4.18-rc8

v4.19

v4.19-rc1

v4.19-rc2

v4.19-rc3

v4.19-rc4

v4.19-rc5

v4.19-rc6

v4.19-rc7

v4.19-rc8

v4.20

v4.20-rc1

v4.20-rc2

v4.20-rc3

v4.20-rc4

v4.20-rc5

v4.20-rc6

v4.20-rc7

v4.9

v4.9-rc4

v4.9-rc5

v4.9-rc6

v4.9-rc7

v4.9-rc8

v5.*

v5.0

v5.0-rc1

v5.0-rc2

v5.0-rc3

v5.0-rc4

v5.0-rc5

v5.0-rc6

v5.0-rc7

v5.0-rc8

v5.1

v5.1-rc1

v5.1-rc2

v5.1-rc3

v5.1-rc4

v5.1-rc5

v5.1-rc6

v5.1-rc7

v5.10

v5.10-rc1

v5.10-rc2

v5.10-rc3

v5.10-rc4

v5.10-rc5

v5.10-rc6

v5.10-rc7

v5.11

v5.11-rc1

v5.11-rc2

v5.11-rc3

v5.11-rc4

v5.11-rc5

v5.11-rc6

v5.11-rc7

v5.12

v5.12-rc1

v5.12-rc1-dontuse

v5.12-rc2

v5.12-rc3

v5.12-rc4

v5.12-rc5

v5.12-rc6

v5.12-rc7

v5.12-rc8

v5.13

v5.13-rc1

v5.13-rc2

v5.13-rc3

v5.13-rc4

v5.13-rc5

v5.13-rc6

v5.13-rc7

v5.14

v5.14-rc1

v5.14-rc2

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v5.2

v5.2-rc1

v5.2-rc2

v5.2-rc3

v5.2-rc4

v5.2-rc5

v5.2-rc6

v5.2-rc7

v5.3

v5.3-rc1

v5.3-rc2

v5.3-rc3

v5.3-rc4

v5.3-rc5

v5.3-rc6

v5.3-rc7

v5.3-rc8

v5.4

v5.4-rc1

v5.4-rc2

v5.4-rc3

v5.4-rc4

v5.4-rc5

v5.4-rc6

v5.4-rc7

v5.4-rc8

v5.5

v5.5-rc1

v5.5-rc2

v5.5-rc3

v5.5-rc4

v5.5-rc5

v5.5-rc6

v5.5-rc7

v5.6

v5.6-rc1

v5.6-rc2

v5.6-rc3

v5.6-rc4

v5.6-rc5

v5.6-rc6

v5.6-rc7

v5.7

v5.7-rc1

v5.7-rc2

v5.7-rc3

v5.7-rc4

v5.7-rc5

v5.7-rc6

v5.7-rc7

v5.8

v5.8-rc1

v5.8-rc2

v5.8-rc3

v5.8-rc4

v5.8-rc5

v5.8-rc6

v5.8-rc7

v5.9

v5.9-rc1

v5.9-rc2

v5.9-rc3

v5.9-rc4

v5.9-rc5

v5.9-rc6

v5.9-rc7

v5.9-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.10

v6.10-rc1

v6.10-rc2

v6.10-rc3

v6.10-rc4

v6.10-rc5

v6.10-rc6

v6.10-rc7

v6.11

v6.11-rc1

v6.11-rc2

v6.11-rc3

v6.11-rc4

v6.11-rc5

v6.11-rc6

v6.11-rc7

v6.12

v6.12-rc1

v6.12-rc2

v6.12-rc3

v6.12-rc4

v6.12-rc5

v6.12-rc6

v6.12-rc7

v6.12.1

v6.12.10

v6.12.11

v6.12.12

v6.12.13

v6.12.14

v6.12.15

v6.12.2

v6.12.3

v6.12.4

v6.12.5

v6.12.6

v6.12.7

v6.12.8

v6.12.9

v6.13

v6.13-rc1

v6.13-rc2

v6.13-rc3

v6.13-rc4

v6.13-rc5

v6.13-rc6

v6.13-rc7

v6.13.1

v6.13.2

v6.13.3

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "target": {
            "file": "net/ipv6/ioam6_iptunnel.c"
        },
        "id": "CVE-2025-21768-0094c5e1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c0f200c7d06fedddde82209c099014d63f4a6c0",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "280690303140345657236225507030147640859",
                "228504725995135750280460012106525341662",
                "192976896152847541284817734770178014747",
                "141391205814793284014287905048516954594",
                "252714960796057922653559807989092474712",
                "15322385651258225508895086556143028367"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/ipv6/rpl_iptunnel.c"
        },
        "id": "CVE-2025-21768-0264516f",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab11a4e219e93b8b31a27f8ec98d42afadd8b7a",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283072418055132943891772203735559189842",
                "95763414589932661340808920215615748361",
                "71378952532805857753656074003113399355",
                "70214460682978976996958534802752849648",
                "88988575627839688942246522614559121417",
                "215455324510682821853191299222604326390"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "rpl_output",
            "file": "net/ipv6/rpl_iptunnel.c"
        },
        "id": "CVE-2025-21768-0ce39e95",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92191dd1073088753821b862b791dcc83e558e07",
        "digest": {
            "function_hash": "67618540442232960566787045417434416721",
            "length": 1045.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/ipv6/rpl_iptunnel.c"
        },
        "id": "CVE-2025-21768-2cb45262",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92191dd1073088753821b862b791dcc83e558e07",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "294324234399964551513411673132999104057",
                "95763414589932661340808920215615748361",
                "71378952532805857753656074003113399355",
                "70214460682978976996958534802752849648",
                "88988575627839688942246522614559121417",
                "215455324510682821853191299222604326390"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/ipv6/seg6_iptunnel.c"
        },
        "id": "CVE-2025-21768-2e9151a8",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92191dd1073088753821b862b791dcc83e558e07",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "294324234399964551513411673132999104057",
                "135246341391318862416115336076931916875",
                "205475050419444399562093401343376574448",
                "167162748505365435990370043431629293474",
                "295592162547470626667005225765750640484",
                "215455324510682821853191299222604326390"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "rpl_output",
            "file": "net/ipv6/rpl_iptunnel.c"
        },
        "id": "CVE-2025-21768-588b058c",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c0f200c7d06fedddde82209c099014d63f4a6c0",
        "digest": {
            "function_hash": "137925402209720419549207231915977479266",
            "length": 1045.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "ioam6_output",
            "file": "net/ipv6/ioam6_iptunnel.c"
        },
        "id": "CVE-2025-21768-71885824",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92191dd1073088753821b862b791dcc83e558e07",
        "digest": {
            "function_hash": "120445356919749025277127757733524595544",
            "length": 1900.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "seg6_output_core",
            "file": "net/ipv6/seg6_iptunnel.c"
        },
        "id": "CVE-2025-21768-7b02962f",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c0f200c7d06fedddde82209c099014d63f4a6c0",
        "digest": {
            "function_hash": "339712289370370456289174317655910282268",
            "length": 1212.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/ipv6/seg6_iptunnel.c"
        },
        "id": "CVE-2025-21768-857918fb",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c0f200c7d06fedddde82209c099014d63f4a6c0",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283072418055132943891772203735559189842",
                "135246341391318862416115336076931916875",
                "205475050419444399562093401343376574448",
                "167162748505365435990370043431629293474",
                "295592162547470626667005225765750640484",
                "215455324510682821853191299222604326390"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "seg6_output_core",
            "file": "net/ipv6/seg6_iptunnel.c"
        },
        "id": "CVE-2025-21768-8c219d92",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92191dd1073088753821b862b791dcc83e558e07",
        "digest": {
            "function_hash": "120500994527312567668649291651010131589",
            "length": 1212.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/ipv6/ioam6_iptunnel.c"
        },
        "id": "CVE-2025-21768-9a08833a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab11a4e219e93b8b31a27f8ec98d42afadd8b7a",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "280690303140345657236225507030147640859",
                "228504725995135750280460012106525341662",
                "192976896152847541284817734770178014747",
                "141391205814793284014287905048516954594",
                "252714960796057922653559807989092474712",
                "15322385651258225508895086556143028367"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "ioam6_output",
            "file": "net/ipv6/ioam6_iptunnel.c"
        },
        "id": "CVE-2025-21768-aa355364",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c0f200c7d06fedddde82209c099014d63f4a6c0",
        "digest": {
            "function_hash": "213566461009966369807571420835959361290",
            "length": 1874.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "seg6_output_core",
            "file": "net/ipv6/seg6_iptunnel.c"
        },
        "id": "CVE-2025-21768-bc95f01a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab11a4e219e93b8b31a27f8ec98d42afadd8b7a",
        "digest": {
            "function_hash": "339712289370370456289174317655910282268",
            "length": 1212.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "rpl_output",
            "file": "net/ipv6/rpl_iptunnel.c"
        },
        "id": "CVE-2025-21768-bf457430",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab11a4e219e93b8b31a27f8ec98d42afadd8b7a",
        "digest": {
            "function_hash": "137925402209720419549207231915977479266",
            "length": 1045.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/ipv6/ioam6_iptunnel.c"
        },
        "id": "CVE-2025-21768-c6fdc190",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92191dd1073088753821b862b791dcc83e558e07",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "49723072640728276608391116043767620534",
                "228504725995135750280460012106525341662",
                "192976896152847541284817734770178014747",
                "141391205814793284014287905048516954594",
                "252714960796057922653559807989092474712",
                "15322385651258225508895086556143028367"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/ipv6/rpl_iptunnel.c"
        },
        "id": "CVE-2025-21768-c79527f3",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c0f200c7d06fedddde82209c099014d63f4a6c0",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283072418055132943891772203735559189842",
                "95763414589932661340808920215615748361",
                "71378952532805857753656074003113399355",
                "70214460682978976996958534802752849648",
                "88988575627839688942246522614559121417",
                "215455324510682821853191299222604326390"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "ioam6_output",
            "file": "net/ipv6/ioam6_iptunnel.c"
        },
        "id": "CVE-2025-21768-cc6e0782",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab11a4e219e93b8b31a27f8ec98d42afadd8b7a",
        "digest": {
            "function_hash": "213566461009966369807571420835959361290",
            "length": 1874.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/ipv6/seg6_iptunnel.c"
        },
        "id": "CVE-2025-21768-d3bea36b",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab11a4e219e93b8b31a27f8ec98d42afadd8b7a",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283072418055132943891772203735559189842",
                "135246341391318862416115336076931916875",
                "205475050419444399562093401343376574448",
                "167162748505365435990370043431629293474",
                "295592162547470626667005225765750640484",
                "215455324510682821853191299222604326390"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.10.0

Fixed

6.12.16

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.13.4