Linux Kernel Vulnerability in IGMP Protocol Operations

CVE-2025-21759

Summary

A vulnerability in the Linux kernel related to the IGMP (Internet Group Management Protocol) operations can lead to potential use-after-free issues. The flaw occurs when the function igmp6_send() is called without the appropriate RCU (Read-Copy-Update) or RTNL (Routing Netlink) protections being held, which may compromise network functionality and stability. To mitigate this issue, RCU protection has been extended to safely retrieve the net pointer, thus avoiding the potential for exploitation. The method has also been adjusted to utilize alloc_skb() instead of sock_alloc_send_skb() to prevent the use of GFP_KERNEL allocations that may lead to sleeping under RCU conditions.

References