Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-21719— ipmr: do not call mr_mfc_uses_dev() for unres entries

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ipmr对未解析条目调用mr_mfc_uses_dev。

CVSS 7.1 · High EPSS 0.21% · P10

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux cb167893f41e21e6bd283d78e53489289dc0592d< 71a0fcb68c0a5f3ec912b540cd5d72148e6ee5f1 affected
cb167893f41e21e6bd283d78e53489289dc0592d< 53df27fd38f84bd3cd6b004eb4ff3c4903114f1d affected
cb167893f41e21e6bd283d78e53489289dc0592d< 547ef7e8cbb98f966c8719a3e15d4e078aaa9b47 affected
cb167893f41e21e6bd283d78e53489289dc0592d< 57177c5f47a8da852f8d76cf6945cf803f8bb9e5 affected
cb167893f41e21e6bd283d78e53489289dc0592d< b379b3162ff55a70464c6a934ae9bf0497478a62 affected
cb167893f41e21e6bd283d78e53489289dc0592d< a099834a51ccf9bbba3de86a251b3433539abfde affected
cb167893f41e21e6bd283d78e53489289dc0592d< 26bb7d991f04eeef47dfad23e533834995c26f7a affected
cb167893f41e21e6bd283d78e53489289dc0592d< 15a901361ec3fb1c393f91880e1cbf24ec0a88bd affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21719

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipmr: do not call mr_mfc_uses_dev() for unres entries
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipmr: do not call mr_mfc_uses_dev() for unres entries syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif alias to "struct sk_buff_head unresolved", which contain two pointers. This code never worked, lets remove it. [1] Unable to handle kernel paging request at virtual address ffff5fff2d536613 KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] Modules linked in: CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline] lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 Call trace: mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P) mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P) mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382 ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648 rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327 rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791 netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317 netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973 sock_recvmsg_nosec net/socket.c:1033 [inline] sock_recvmsg net/socket.c:1055 [inline] sock_read_iter+0x2d8/0x40c net/socket.c:1125 new_sync_read fs/read_write.c:484 [inline] vfs_read+0x740/0x970 fs/read_write.c:565 ksys_read+0x15c/0x26c fs/read_write.c:708
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ipmr对未解析条目调用mr_mfc_uses_dev。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux cb167893f41e21e6bd283d78e53489289dc0592d ~ 71a0fcb68c0a5f3ec912b540cd5d72148e6ee5f1 -
Linux Linux 4.20 -

II. Public POCs for CVE-2025-21719

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21719

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21719 (5)

Other References for CVE-2025-21719 (2)

Same Patch Batch · Linux · 2025-02-27 · 177 CVEs total

CVE-2025-21748 9.8 CRITICAL ksmbd: fix integer overflows on 32 bit systems
CVE-2025-21707 9.8 CRITICAL mptcp: consolidate suboption status
CVE-2025-21796 9.8 CRITICAL nfsd: clear acl_access/acl_default after releasing them
CVE-2025-21805 9.8 CRITICAL RDMA/rtrs: Add missing deinit() call
CVE-2024-58006 9.6 CRITICAL PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
CVE-2024-57999 8.8 HIGH powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
CVE-2024-57997 8.8 HIGH wifi: wcn36xx: fix channel survey memory allocation size
CVE-2024-57995 8.8 HIGH wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()
CVE-2025-21735 8.8 HIGH NFC: nci: Add bounds checking in nci_hci_create_pipe()
CVE-2025-21710 8.2 HIGH tcp: correct handling of extreme memory squeeze
CVE-2024-57973 8.1 HIGH rdma/cxgb4: Prevent potential integer overflow on 32bit
CVE-2025-21760 8.1 HIGH ndisc: extend RCU protection in ndisc_send_skb()
CVE-2025-21762 8.1 HIGH arp: use RCU protection in arp_xmit()
CVE-2025-21765 8.1 HIGH ipv6: use RCU protection in ip6_default_advmss()
CVE-2025-21766 8.1 HIGH ipv4: use RCU protection in __ip_rt_update_pmtu()
CVE-2025-21801 7.8 HIGH net: ravb: Fix missing rtnl lock in suspend/resume path
CVE-2025-21722 7.8 HIGH nilfs2: do not force clear folio if buffer is referenced
CVE-2024-58003 7.8 HIGH media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
CVE-2024-58034 7.8 HIGH memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
CVE-2024-54458 7.8 HIGH scsi: ufs: bsg: Set bsg_queue to NULL after removal

Showing top 20 of 177 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21719

No comments yet

Leave a comment