CVE-2025-22005

What it actually does

Memory leak of nhc_pcpu_rth_output percpu allocation in fib6_nh_init() error path when fib6_nh->rt6i_pcpu allocation fails after fib_nh_common_init() has run, because fib_check_nh_v6_gw() assumes complete cleanup on failure.

Why it matters to the business

Gradual kernel memory exhaustion on systems performing IPv6 route lookups or gateway configuration under failure conditions, potentially leading to resource starvation and service disruption in high-traffic or dynamic routing environments; low EPSS and no KEV listing reduce immediate urgency despite 573 days since publication.

How an attack unfolds

An attacker with ability to trigger IPv6 route or gateway configuration failures (for example via repeated invalid route additions or during interface events) can cause the kernel to leak percpu memory on each failed fib6_nh_init() call without corresponding release, amplifying the leak through sustained triggering; listed threat actors associated with other Linux kernel privilege-escalation CVEs may seek to chain this for denial-of-service.

How to fix it

Apply the upstream fix commit 16267a5036173d0173377545b4b6021b081d0933 or later; for Red Hat Enterprise Linux 8 appstream packages update to the listed fixed versions such as dotnet-runtime-3.1-0:3.1.15-1.el8_4 and dotnet-sdk-3.1-0:3.1.115-1.el8_4; rebuild and reboot into the patched kernel; remove the erroneous fib6_nh_release() call in nh_create_ipv6() when rebasing to net-next.

How to confirm the fix worked

Verify the presence of the commit 16267a5036173d0173377545b4b6021b081d0933 in the running kernel source or package changelog; exercise fib_check_nh_v6_gw() failure paths under memory pressure and confirm no growth in percpu allocations via /proc/meminfo or slabinfo; confirm fixed dotnet package versions are installed via rpm -q.

Typical attack path

1. Obtain local or network-adjacent access sufficient to influence IPv6 routing tables or trigger fib_check_nh_v6_gw() calls
2. Craft repeated route or gateway operations that force fib6_nh_init() to reach the rt6i_pcpu allocation failure after nhc_pcpu_rth_output has been initialized
3. Repeat the failure-inducing sequence to accumulate leaked percpu memory until kernel resources are depleted

How to detect it

Review kernel slab allocator statistics and percpu memory counters for unexpected growth tied to fib6_nh or nhc_pcpu_rth_output objects; inspect system logs for repeated IPv6 route configuration failures around the time of suspected leaks; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on all IPv6-enabled systems within change windows given the long publication window
• Monitor memory usage trends on routers and hosts handling dynamic IPv6 routes
• Include the fix in next planned kernel or dotnet runtime patching cycle even though EPSS remains low