CVE-2025-21678
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Jan 31, 2025
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's handling of certain network devices can cause the system to crash when network setups are torn down, requiring an update to prevent instability.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The GTP device is incorrectly linked to dev_net(dev) rather than the src_net of the UDP tunnel socket in gtp_newlink(), leaving a dangling reference when the socket's netns is dismantled and triggering a refcount warning and potential memory corruption during netns cleanup.
Why it matters to the business
Systems running affected kernels may experience crashes or instability during network namespace teardown in containerized or virtualized environments, increasing operational risk and requiring urgent patching on any exposed Linux hosts.
How an attack unfolds
An attacker with local privileges creates network namespaces and a GTP device spanning them, then triggers deletion of the socket's namespace to force the kernel into an inconsistent state that can be leveraged for denial of service or further memory corruption exploitation.
How to fix it
Upgrade to a kernel containing commit c986380c1d5274c4d5e935addc807d6791cc23eb or later; rebuild and reboot all affected systems. No configuration workarounds exist.
How to confirm the fix worked
Confirm the running kernel contains commit c986380c1d5274c4d5e935addc807d6791cc23eb; attempt to reproduce the namespace creation and deletion sequence and verify absence of the ref_tracker warning.
Typical attack path
- Create multiple network namespaces
- Create a GTP device with UDP socket in a separate namespace
- Trigger deletion of the socket namespace
- Observe ref_tracker warning and kernel oops during netns cleanup
How to detect it
Search kernel logs for ref_tracker_dir_exit warnings mentioning net notrefcnt during netns cleanup or gtp device teardown; inspect audit logs for unusual namespace and GTP device creation sequences.
What your security team should do
- Prioritize kernel updates on all multi-tenant or container hosts within the next maintenance window
- Monitor for kernel oops and ref_tracker warnings in system logs
- Restrict unprivileged namespace creation where feasible until patches are applied
The record
In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created. Even when src_net is removed, the device stays alive on dev_net(dev). Then, removing src_net triggers the splat below. [0] In this example, gtp0 is created in ns2, and the udp socket is created in ns1. ip netns add ns1 ip netns add ns2 ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn ip netns del ns1 Let's link the device to the socket's netns instead. Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove all gtp devices in the netns. [0]: ref_tracker: net notrefcnt@000000003d6e7d05 has 1/2 users at sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236) inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1558) udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18) gtp_create_sock (./include/net/udp_tunnel.h:59 drivers/net/gtp.c:1423) gtp_create_sockets (drivers/net/gtp.c:1447) gtp_newlink (drivers/net/gtp.c:1507) rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012) rtnetlink_rcv_msg (net/core/rtnetlink.c:6922) netlink_rcv_skb (net/netlink/af_netlink.c:2542) netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347) netlink_sendmsg (net/netlink/af_netlink.c:1891) ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583) ___sys_sendmsg (net/socket.c:2639) __sys_sendmsg (net/socket.c:2669) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) WARNING: CPU: 1 PID: 60 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179) Modules linked in: CPU: 1 UID: 0 PID: 60 Comm: kworker/u16:2 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179) Code: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f> 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89 RSP: 0018:ff11000009a07b60 EFLAGS: 00010286 RAX: 0000000000002bd3 RBX: ff1100000f4e1aa0 RCX: 1ffffffff0e40ac6 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c RBP: ff1100000f4e1af0 R08: 0000000000000001 R09: fffffbfff0e395ae R10: 0000000000000001 R11: 0000000000036001 R12: ff1100000f4e1af0 R13: dead000000000100 R14: ff1100000f4e1af0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9b2464bd98 CR3: 0000000005286005 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn (kernel/panic.c:748) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:285) ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) ? ref_tracker_dir_exit (lib/ref_tracker.c:179) ? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158) ? kfree (mm/slub.c:4613 mm/slub.c:4761) net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467) cleanup_net (net/core/net_namespace.c:664 (discriminator 3)) process_one_work (kernel/workqueue.c:3229) worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391 ---truncated---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:11 | linux | 0 | 5.10.234-1 |
| Debian:11 | linux-6.1 | 0 | 6.1.128-1~deb11u1 |
| Debian:11 | linux-6.1 | 0 | 6.1.6.1.128-1~deb11u1 |
| Debian:12 | linux | 0 | 6.1.128-1 |
| Debian:13 | linux | 0 | 6.12.11-1 |
| Linux | Kernel | 4.7.0 | 5.4.290 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kernel-default | 0 | 4.12.14-122.247.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_65 | 0 | 1-8.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_8 | 0 | 1-150600.1.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_8 | 0 | 1-150600.13.3.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.38.1.150600.12.16.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.15.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.15.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.15.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.15.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.26.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.26.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.26.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-default | 0 | 4.12.14-122.247.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-source | 0 | 4.12.14-122.247.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-syms | 0 | 4.12.14-122.247.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-default | 0 | 4.12.14-122.247.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-source | 0 | 4.12.14-122.247.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-syms | 0 | 4.12.14-122.247.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.38.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.26.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.26.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.26.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.26.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.26.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.38.1.150600.12.16.2 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.26.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.26.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.26.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.26.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.38.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.26.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.26.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.38.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux