LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels Some lwtunnels have a dst cache for post-transformation dst. If the packet destination did not change we may end up recording a reference to the lwtunnel in its own cache, and the lwtunnel state will never be freed. Discovered by the ioam6.sh test, kmemleak was recently fixed to catch per-cpu memory leaks. I'm not sure if rpl and seg6 can actually hit this, but in principle I don't see why not.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-21768 is a Linux kernel IPv6 networking bug where certain lightweight tunnel paths can keep a reference to themselves and never free memory. The public record does not provide CVSS, confirmed exploitation, or a direct business impact rating.

Executive priority

Treat this as a patch-management item, not an emergency, unless affected IPv6 tunnel features are in production. The main known risk is kernel memory not being freed, which could affect availability over time. Reassess if vendors publish severity, operational impact, or exploitation details.

Technical view

The flaw involves dst reference loops in IPv6 lwtunnel dst caches for RPL, seg6, and ioam6. If packet destination remains unchanged after transformation, the tunnel may cache itself, preventing lwtunnel state cleanup. The issue was found by ioam6.sh with kmemleak improvements.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions with IPv6 lightweight tunnel functionality involving RPL, Segment Routing, or IOAM6. The source bundle lists Linux as affected but does not map exposure to specific distributions, appliances, or cloud images.

Exploitation context

No active exploitation is cited, and the CVE is not marked KEV. The source text describes a memory leak condition discovered during testing, not a public exploit path. It also notes uncertainty about whether RPL and seg6 can actually trigger it.

Researcher notes

The record is unusually sparse: no CVSS, no CWE, and no exploit evidence. The kernel description points to self-referential dst cache behavior after unchanged packet destinations. The author explicitly states uncertainty about RPL and seg6 reachability, so validation should separate theoretical exposure from configured feature use.

Mitigation direction

  • Check Linux kernel and distribution advisories for CVE-2025-21768 guidance.
  • Upgrade to a kernel package containing the referenced stable fixes.
  • Prioritize hosts using IPv6 RPL, seg6, or IOAM6 lwtunnel functionality.
  • Track vendor backports if using distribution-maintained kernels.
  • Document reduced exposure where these IPv6 tunnel features are absent.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and images.
  • Identify systems using IPv6 lightweight tunnel features: RPL, seg6, or IOAM6.
  • Confirm the running kernel includes the referenced stable commits or vendor backports.
  • Review kernel memory leak telemetry as supporting evidence, not proof of exploit.
  • Monitor CVE and vendor advisories for severity or exploit-status changes.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21768 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6c8702c60b88651072460f3f4026c7dfe2521d12, 6c8702c60b88651072460f3f4026c7dfe2521d12, 6c8702c60b88651072460f3f4026c7dfe2521d12unaffected
LinuxLinux4.10, 0, 6.12.16, 6.13.4, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.