cve/published/2025/CVE-2025-21677.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2025-21677: pfcp: Destroy device along with udp socket's netns dismantle.

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 pfcp: Destroy device along with udp socket's netns dismantle.

 pfcp_newlink() links the device to a list in dev_net(dev) instead
 of net, where a udp tunnel socket is created.

 Even when net is removed, the device stays alive on dev_net(dev).
 Then, removing net triggers the splat below. [0]

 In this example, pfcp0 is created in ns2, but the udp socket is
 created in ns1.

   ip netns add ns1
   ip netns add ns2
   ip -n ns1 link add netns ns2 name pfcp0 type pfcp
   ip netns del ns1

 Let's link the device to the socket's netns instead.

 Now, pfcp_net_exit() needs another netdev iteration to remove
 all pfcp devices in the netns.

 pfcp_dev_list is not used under RCU, so the list API is converted
 to the non-RCU variant.

 pfcp_net_exit() can be converted to .exit_batch_rtnl() in net-next.

 [0]:
 ref_tracker: net notrefcnt@00000000128b34dc has 1/1 users at
      sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236)
      inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252)
      __sock_create (net/socket.c:1558)
      udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18)
      pfcp_create_sock (drivers/net/pfcp.c:168)
      pfcp_newlink (drivers/net/pfcp.c:182 drivers/net/pfcp.c:197)
      rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012)
      rtnetlink_rcv_msg (net/core/rtnetlink.c:6922)
      netlink_rcv_skb (net/netlink/af_netlink.c:2542)
      netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347)
      netlink_sendmsg (net/netlink/af_netlink.c:1891)
      ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583)
      ___sys_sendmsg (net/socket.c:2639)
      __sys_sendmsg (net/socket.c:2669)
      do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
      entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

 WARNING: CPU: 1 PID: 11 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179)
 Modules linked in:
 CPU: 1 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
 Workqueue: netns cleanup_net
 RIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179)
 Code: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f> 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89
 RSP: 0018:ff11000007f3fb60 EFLAGS: 00010286
 RAX: 00000000000020ef RBX: ff1100000d6481e0 RCX: 1ffffffff0e40d82
 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c
 RBP: ff1100000d648230 R08: 0000000000000001 R09: fffffbfff0e395af
 R10: 0000000000000001 R11: 0000000000000000 R12: ff1100000d648230
 R13: dead000000000100 R14: ff1100000d648230 R15: dffffc0000000000
 FS:  0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00005620e1363990 CR3: 000000000eeb2002 CR4: 0000000000771ef0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
 PKRU: 55555554
 Call Trace:
  <TASK>
  ? __warn (kernel/panic.c:748)
  ? ref_tracker_dir_exit (lib/ref_tracker.c:179)
  ? report_bug (lib/bug.c:201 lib/bug.c:219)
  ? handle_bug (arch/x86/kernel/traps.c:285)
  ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1))
  ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)
  ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)
  ? ref_tracker_dir_exit (lib/ref_tracker.c:179)
  ? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158)
  ? kfree (mm/slub.c:4613 mm/slub.c:4761)
  net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467)
  cleanup_net (net/core/net_namespace.c:664 (discriminator 3))
  process_one_work (kernel/workqueue.c:3229)
  worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391)
  kthread (kernel/kthread.c:389)
  ret_from_fork (arch/x86/kernel/process.c:147)
  ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
   </TASK>

 The Linux kernel CVE team has assigned CVE-2025-21677 to this issue.


 Affected and fixed versions
 ===========================

 	Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 6.12.11 with commit 1c35a66e2bfea53dea3562b2575ac7fd4c38ee61
 	Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 6.13 with commit ffc90e9ca61b0f619326a1417ff32efd6cc71ed2

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2025-21677
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	drivers/net/pfcp.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/1c35a66e2bfea53dea3562b2575ac7fd4c38ee61
 	https://git.kernel.org/stable/c/ffc90e9ca61b0f619326a1417ff32efd6cc71ed2
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2025-21677: pfcp: Destroy device along with udp socket's netns dismantle.

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	pfcp: Destroy device along with udp socket's netns dismantle.

	pfcp_newlink() links the device to a list in dev_net(dev) instead
	of net, where a udp tunnel socket is created.

	Even when net is removed, the device stays alive on dev_net(dev).
	Then, removing net triggers the splat below. [0]

	In this example, pfcp0 is created in ns2, but the udp socket is
	created in ns1.

	ip netns add ns1
	ip netns add ns2
	ip -n ns1 link add netns ns2 name pfcp0 type pfcp
	ip netns del ns1

	Let's link the device to the socket's netns instead.

	Now, pfcp_net_exit() needs another netdev iteration to remove
	all pfcp devices in the netns.

	pfcp_dev_list is not used under RCU, so the list API is converted
	to the non-RCU variant.

	pfcp_net_exit() can be converted to .exit_batch_rtnl() in net-next.

	[0]:
	ref_tracker: net notrefcnt@00000000128b34dc has 1/1 users at
	sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236)
	inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252)
	__sock_create (net/socket.c:1558)
	udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18)
	pfcp_create_sock (drivers/net/pfcp.c:168)
	pfcp_newlink (drivers/net/pfcp.c:182 drivers/net/pfcp.c:197)
	rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012)
	rtnetlink_rcv_msg (net/core/rtnetlink.c:6922)
	netlink_rcv_skb (net/netlink/af_netlink.c:2542)
	netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347)
	netlink_sendmsg (net/netlink/af_netlink.c:1891)
	____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583)
	___sys_sendmsg (net/socket.c:2639)
	__sys_sendmsg (net/socket.c:2669)
	do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
	entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

	WARNING: CPU: 1 PID: 11 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179)
	Modules linked in:
	CPU: 1 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5
	Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
	Workqueue: netns cleanup_net
	RIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179)
	Code: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f> 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89
	RSP: 0018:ff11000007f3fb60 EFLAGS: 00010286
	RAX: 00000000000020ef RBX: ff1100000d6481e0 RCX: 1ffffffff0e40d82
	RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c
	RBP: ff1100000d648230 R08: 0000000000000001 R09: fffffbfff0e395af
	R10: 0000000000000001 R11: 0000000000000000 R12: ff1100000d648230
	R13: dead000000000100 R14: ff1100000d648230 R15: dffffc0000000000
	FS: 0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000
	CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 00005620e1363990 CR3: 000000000eeb2002 CR4: 0000000000771ef0
	DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
	DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
	PKRU: 55555554
	Call Trace:
	<TASK>
	? __warn (kernel/panic.c:748)
	? ref_tracker_dir_exit (lib/ref_tracker.c:179)
	? report_bug (lib/bug.c:201 lib/bug.c:219)
	? handle_bug (arch/x86/kernel/traps.c:285)
	? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1))
	? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)
	? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)
	? ref_tracker_dir_exit (lib/ref_tracker.c:179)
	? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158)
	? kfree (mm/slub.c:4613 mm/slub.c:4761)
	net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467)
	cleanup_net (net/core/net_namespace.c:664 (discriminator 3))
	process_one_work (kernel/workqueue.c:3229)
	worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391)
	kthread (kernel/kthread.c:389)
	ret_from_fork (arch/x86/kernel/process.c:147)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
	</TASK>

	The Linux kernel CVE team has assigned CVE-2025-21677 to this issue.


	Affected and fixed versions
	===========================

	Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 6.12.11 with commit 1c35a66e2bfea53dea3562b2575ac7fd4c38ee61
	Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 6.13 with commit ffc90e9ca61b0f619326a1417ff32efd6cc71ed2

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21677
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	drivers/net/pfcp.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/1c35a66e2bfea53dea3562b2575ac7fd4c38ee61
	https://git.kernel.org/stable/c/ffc90e9ca61b0f619326a1417ff32efd6cc71ed2