TCP Vulnerability in Linux Kernel Affecting Multiple Network Configurations

CVE-2025-21864

What is CVE-2025-21864?

A vulnerability has been identified in the Linux kernel related to TCP packet processing. The issue arises during the deletion of network namespaces where a lingering reference to an xfrm_state object prevents proper cleanup. When network namespaces are deleted prematurely, references from the security path (secpath) remain attached to socket buffers (skb), potentially leading to unexpected behavior during packet handling. The problem manifests particularly in scenarios where TCP tests are executed over ipcomp6 configurations. To resolve the issue, adjustments have been made to ensure that secpath references are dropped alongside the destination state, enhancing the stability and security of network operations.

References