CVE-2025-21972

MediumCVSS 5.5/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: unshare packets when reassembling

Ensure that the frag_list used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and prevents a memory leak due to circular references between fragments and their skb_shared_info.

The upcoming MCTP-over-USB driver uses skb_clone which can trigger the problem - other MCTP drivers don't share SKBs.

A kunit test is added to reproduce the issue.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
LinuxLinux>= 4a992bbd365094730a31bae1e12a6ca695336d57, < 771087069a27c35c0a9fd7cc74fe7725b189b96b; >= 4a992bbd365094730a31bae1e12a6ca695336d57, < 3d0281d0713952e8dd14d6d47e3a9c345c28a3b7; >= 4a992bbd365094730a31bae1e12a6ca695336d57, < 5c47d5bfa7b096cf8890afac32141c578583f8e0; >= 4a992bbd365094730a31bae1e12a6ca695336d57, < f44fff3d3c6cd67b6f348b821d73c4d6888c7a6e; >= 4a992bbd365094730a31bae1e12a6ca695336d57, < f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc
LinuxLinux5.15

References

Timeline

Published
Apr 1, 2025
Last modified
Oct 30, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-219737.1In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx} When CVE-2025-219745.5In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc() CVE-2025-219755.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: handle errors in mlx5_chains_create_table() In mlx5_chains_cCVE-2025-219765.5In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Allow graceful removal of framebuffer When a Hyper-VCVE-2025-219775.5In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs GCVE-2025-219785.5In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: Fix address space leak when Hyper-V DRM device is removed CVE-2025-219797.8In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel wiphy_work before freeing wiphy A wiphy_work caCVE-2025-219805.5In the Linux kernel, the following vulnerability has been resolved: sched: address a potential NULL pointer dereference in the GRED schedulCVE-2025-219815.5In the Linux kernel, the following vulnerability has been resolved: ice: fix memory leak in aRFS after reset Fix aRFS (accelerated ReceiveCVE-2025-219825.5In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw devm_kaspCVE-2025-219837.8In the Linux kernel, the following vulnerability has been resolved: mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq Currently kvfree_rcu()CVE-2025-219844.7In the Linux kernel, the following vulnerability has been resolved: mm: fix kernel BUG when userfaultfd_move encounters swapcache userfaul
CVE-2025-21972: Medium severity, CVSS 5.5 | Vulnix