Linux Kernel Vulnerability in IPsec Tunnel Mode Affecting Multiple Versions

CVE-2025-21674

Summary

The Linux kernel vulnerability arises from an improper locking mechanism when enabling IPsec packet offload in tunnel mode, potentially triggering a kernel panic. This is caused by a sequence of lock dependencies that could result in a deadlock scenario. Specifically, an issue exists in the SA add section where the appropriate _bh() variant should be employed for marking SA mode, while the flush_workqueue in the SA delete routine is deemed unnecessary. This vulnerability calls for immediate attention to avoid service interruptions and maintain network security.

References