CVE-2025-21768

What it actually does

The flaw creates a self-referential dst cache entry in IPv6 lwtunnels (rpl, seg6, ioam6) when the post-transformation destination is unchanged, forming a reference-count loop that prevents the tunnel state from ever being freed and produces a per-CPU memory leak.

Why it matters to the business

Gradual kernel memory exhaustion can degrade performance or trigger out-of-memory conditions on Linux systems; the single downstream dependent increases the blast radius only marginally and there is no ransomware or KEV usage.

How an attack unfolds

An attacker with the ability to configure or influence IPv6 lightweight tunnel state (for example via crafted packets or user-space tunnel setup) triggers the dst cache to store a reference to itself; repeated triggering leaks memory until the system becomes unstable. No public exploit exists and the listed threat-actor references pertain to unrelated kernel privilege-escalation CVEs.

How to fix it

Upgrade the Linux kernel to a version containing the referenced fix; for the downstream salt package update to version 3003.3. Where immediate patching is impossible, avoid use of the affected tunnel types or isolate the systems.

How to confirm the fix worked

Confirm the running kernel contains the upstream commit that resolves the dst refcount loop; re-run the ioam6.sh test suite and verify kmemleak no longer reports per-CPU leaks for rpl/seg6/ioam6 objects; check salt version is at least 3003.3.

Typical attack path

1. Obtain sufficient privileges to create or modify IPv6 lwtunnel objects
2. Configure an rpl, seg6 or ioam6 tunnel whose destination remains unchanged after transformation
3. Send traffic that populates the dst cache with a self-reference
4. Repeat to accumulate per-CPU memory leaks until resource exhaustion

How to detect it

Inspect kmemleak reports for leaked dst objects tied to rpl, seg6 or ioam6 tunnels; monitor kernel slab or per-CPU memory counters for unexplained growth after tunnel configuration; review system logs for repeated tunnel setup operations.

What your security team should do

• Prioritize kernel updates on any system using IPv6 lwtunnels
• Upgrade salt to 3003.3 across the environment
• Enable kmemleak or similar kernel memory-leak detectors in staging and production
• Review network configurations to minimize unnecessary rpl/seg6/ioam6 tunnel usage