AZL-59064
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-59064.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-59064
- Upstream
- Published
- 2025-02-27T03:15:16Z
- Modified
- 2026-04-01T05:19:24.174437Z
- Summary
- CVE-2025-21759 affecting package kernel for versions less than 6.6.82.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: extend RCU protection in igmp6_send()
igmp6_send() can be called without RTNL or RCU being held.
Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF.
Note that we no longer can use sockallocsendskb() because ipv6.igmpsk uses GFP_KERNEL allocations which can sleep.
Instead use allocskb() and charge the net->ipv6.igmpsk socket under RCU protection.
- References