CVE-2025-21719

What it actually does

Invalid call to mr_mfc_uses_dev() on unresolved MFC entries causes kernel paging fault by misinterpreting sk_buff_head pointers as vif indices, resulting in wild memory access and crash.

Why it matters to the business

Local users or processes can trigger kernel crashes on systems using IP multicast routing, causing denial of service and potential data loss; low urgency given absent KEV status and stable low EPSS, though widespread Linux kernel exposure increases operational risk.

How an attack unfolds

An attacker with local access crafts netlink route dump requests that reach mr_table_dump and mr_mfc_uses_dev on unresolved entries; the kernel dereferences invalid memory, crashes, and may be chained with other local kernel flaws for privilege escalation in related campaigns.

How to fix it

Update Linux kernel to a version containing the fix that removes the mr_mfc_uses_dev call for unres entries; for listed downstream packages such as pytorch-lightning upgrade to version 1.6.0 or later.

How to confirm the fix worked

Confirm kernel version no longer contains the mr_mfc_uses_dev call at ipmr_base.c:290; reproduce the syzbot reproducer and verify absence of paging fault; scan for affected netlink handling paths.

Typical attack path

1. Obtain local code execution or user shell
2. Trigger rtnl_dump_all via crafted netlink message or ipmr_rtm_dumproute
3. Reach mr_table_dump calling mr_mfc_uses_dev on unres entry
4. Kernel performs invalid memory access leading to panic

How to detect it

Review kernel logs for KASAN or paging request faults referencing mr_mfc_uses_dev or mr_table_dump; inspect netlink traffic and process activity leading to ipmr_rtm_dumproute calls.

What your security team should do

• Prioritize kernel updates on any multicast-routing hosts within standard patch windows
• Monitor EPSS and KEV updates for escalation signals
• Harden local access controls to reduce attack surface for local kernel flaws