LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21719: ipmr: do not call mr_mfc_uses_dev() for unres entries

In the Linux kernel, the following vulnerability has been resolved: ipmr: do not call mr_mfc_uses_dev() for unres entries syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif alias to "struct sk_buff_head unresolved", which contain two pointers. This code never worked, lets remove it. [1] Unable to handle kernel paging request at virtual address ffff5fff2d536613 KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] Modules linked in: CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline] lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 Call trace: mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P) mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P) mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382 ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648 rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327 rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791 netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317 netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973 sock_recvmsg_nosec net/socket.c:1033 [inline] sock_recvmsg net/socket.c:1055 [inline] sock_read_iter+0x2d8/0x40c net/socket.c:1125 new_sync_read fs/read_write.c:484 [inline] vfs_read+0x740/0x970 fs/read_write.c:565 ksys_read+0x15c/0x26c fs/read_write.c:708

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-21719 is a Linux kernel crash bug in IPv4 multicast routing. A kernel code path could treat unresolved route data as a different structure, causing invalid memory access. The available sources do not provide CVSS, confirmed impact beyond crash, or evidence of active exploitation.

Executive priority

Track as a kernel stability vulnerability with unknown severity. Patch during normal-to-expedited maintenance for exposed infrastructure, and prioritize systems with multicast routing roles or vendor advisories. Escalate if your vendor reports active exploitation or broader impact.

Technical view

The flaw is in ipmr route dump handling. Calling mr_mfc_uses_dev() for unresolved multicast forwarding cache entries dereferenced fields that alias a sk_buff_head, leading to a KASAN-reported wild memory access and kernel paging fault. Linux stable commits remove that call for unresolved entries.

Likely exposure

Exposure is limited to systems running affected Linux kernel versions where the IPv4 multicast routing path can be reached. Internet-facing exposure is not established in the sources. Appliances and distributions using vulnerable kernel backports should be checked against vendor advisories.

Exploitation context

The source describes syzbot discovery and a reproducible crash trace. CISA KEV status is false in the bundle, and no cited source states active exploitation. The available evidence supports denial-of-service concern, not proven privilege escalation or remote compromise.

Researcher notes

Evidence is strongest for a crash in net/ipv4/ipmr_base.c during route dumping. The affected-version data is incomplete and should be validated through distribution backports. Avoid assuming remote reachability without local configuration and vendor context.

Mitigation direction

  • Update to a kernel or vendor package containing the referenced stable fix.
  • Check Debian LTS and vendor advisories for backported kernel updates.
  • Prioritize systems using multicast routing or affected network appliances.
  • Follow vendor guidance where kernel version mapping is unclear.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, and appliances.
  • Compare running kernels with vendor fixed versions or referenced stable commits.
  • Review whether IPv4 multicast routing is enabled or operationally required.
  • Confirm Debian LTS or vendor security package installation where applicable.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21719 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
12Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcb167893f41e21e6bd283d78e53489289dc0592d, cb167893f41e21e6bd283d78e53489289dc0592d, cb167893f41e21e6bd283d78e53489289dc0592d, cb167893f41e21e6bd283d78e53489289dc0592d, cb167893f41e21e6bd283d78e53489289dc0592d, cb167893f41e21e6bd283d78e53489289dc0592d, cb167893f41e21e6bd283d78e53489289dc0592d, cb167893f41e21e6bd283d78e53489289dc0592dunaffected
LinuxLinux4.20, 0, 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.76, 6.12.13, 6.13.2, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.