| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-21884: net: better track kernel sockets lifetime |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: better track kernel sockets lifetime |
| |
| While kernel sockets are dismantled during pernet_operations->exit(), |
| their freeing can be delayed by any tx packets still held in qdisc |
| or device queues, due to skb_set_owner_w() prior calls. |
| |
| This then trigger the following warning from ref_tracker_dir_exit() [1] |
| |
| To fix this, make sure that kernel sockets own a reference on net->passive. |
| |
| Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket |
| is converted to a refcounted one. |
| |
| [1] |
| |
| [ 136.263918][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at |
| [ 136.263918][ T35] sk_alloc+0x2b3/0x370 |
| [ 136.263918][ T35] inet6_create+0x6ce/0x10f0 |
| [ 136.263918][ T35] __sock_create+0x4c0/0xa30 |
| [ 136.263918][ T35] inet_ctl_sock_create+0xc2/0x250 |
| [ 136.263918][ T35] igmp6_net_init+0x39/0x390 |
| [ 136.263918][ T35] ops_init+0x31e/0x590 |
| [ 136.263918][ T35] setup_net+0x287/0x9e0 |
| [ 136.263918][ T35] copy_net_ns+0x33f/0x570 |
| [ 136.263918][ T35] create_new_namespaces+0x425/0x7b0 |
| [ 136.263918][ T35] unshare_nsproxy_namespaces+0x124/0x180 |
| [ 136.263918][ T35] ksys_unshare+0x57d/0xa70 |
| [ 136.263918][ T35] __x64_sys_unshare+0x38/0x40 |
| [ 136.263918][ T35] do_syscall_64+0xf3/0x230 |
| [ 136.263918][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f |
| [ 136.263918][ T35] |
| [ 136.343488][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at |
| [ 136.343488][ T35] sk_alloc+0x2b3/0x370 |
| [ 136.343488][ T35] inet6_create+0x6ce/0x10f0 |
| [ 136.343488][ T35] __sock_create+0x4c0/0xa30 |
| [ 136.343488][ T35] inet_ctl_sock_create+0xc2/0x250 |
| [ 136.343488][ T35] ndisc_net_init+0xa7/0x2b0 |
| [ 136.343488][ T35] ops_init+0x31e/0x590 |
| [ 136.343488][ T35] setup_net+0x287/0x9e0 |
| [ 136.343488][ T35] copy_net_ns+0x33f/0x570 |
| [ 136.343488][ T35] create_new_namespaces+0x425/0x7b0 |
| [ 136.343488][ T35] unshare_nsproxy_namespaces+0x124/0x180 |
| [ 136.343488][ T35] ksys_unshare+0x57d/0xa70 |
| [ 136.343488][ T35] __x64_sys_unshare+0x38/0x40 |
| [ 136.343488][ T35] do_syscall_64+0xf3/0x230 |
| [ 136.343488][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f |
| |
| The Linux kernel CVE team has assigned CVE-2025-21884 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.2 with commit 0cafd77dcd032d1687efaba5598cf07bce85997f and fixed in 6.13.6 with commit c31a732fac46b00b95b78fcc9c37cb48dd6f2e0c |
| Issue introduced in 6.2 with commit 0cafd77dcd032d1687efaba5598cf07bce85997f and fixed in 6.14 with commit 5c70eb5c593d64d93b178905da215a9fd288a4b5 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-21884 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| include/net/sock.h |
| net/core/sock.c |
| net/mptcp/subflow.c |
| net/netlink/af_netlink.c |
| net/rds/tcp.c |
| net/smc/af_smc.c |
| net/sunrpc/svcsock.c |
| net/sunrpc/xprtsock.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/c31a732fac46b00b95b78fcc9c37cb48dd6f2e0c |
| https://git.kernel.org/stable/c/5c70eb5c593d64d93b178905da215a9fd288a4b5 |
