cbcvebase.
CVE-2025-21865
published 2025-03-12

CVE-2025-21865: In the Linux kernel, the following vulnerability has been resolved: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). Brad Spengler reported…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
11.8th percentile
In the Linux kernel, the following vulnerability has been resolved: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). Brad Spengler reported the list_del() corruption splat in gtp_net_exit_batch_rtnl(). [0] Commit eb28fd76c0a0 ("gtp: Destroy device along with udp socket's netns dismantle.") added the for_each_netdev() loop in gtp_net_exit_batch_rtnl() to destroy devices in each netns as done in geneve and ip tunnels. However, this could trigger ->dellink() twice for the same device during ->exit_batch_rtnl(). Say we have two netns A & B and gtp device B that resides in netns B but whose UDP socket is in netns A. 1. cleanup_net() processes netns A and then B. 2. gtp_net_exit_batch_rtnl() finds the device B while iterating netns A's gn->gtp_dev_list and calls ->dellink(). [ device B is not yet unlinked from netns B as unregister_netdevice_many() has not been called. ] 3. gtp_net_exit_batch_rtnl() finds the device B while iterating netns B's for_each_netdev() and calls ->dellink(). gtp_dellink() cleans up the device's hash table, unlinks the dev from gn->gtp_dev_list, and calls unregister_netdevice_queue(). Basically, calling gtp_dellink() multiple times is fine unless CONFIG_DEBUG_LIST is enabled. Let's remove for_each_netdev() in gtp_net_exit_batch_rtnl() and delegate the destruction to default_device_exit_batch() as done in bareudp. [0]: list_del corruption, ffff8880aaa62c00->next (autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]) is LIST_POISON1 (ffffffffffffff02) (prev is 0xffffffffffffff04) kernel BUG at lib/list_debug.c:58! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 UID: 0 PID: 1804 Comm: kworker/u8:7 Tainted: G T 6.12.13-grsec-full-20250211091339 #1 Tainted: [T]=RANDSTRUCT Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:[] __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58 Code: c2 76 91 31

Affected

32 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
debianlinux-6.1< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
linuxlinux
linuxlinux>= 036f8d814a2cd11ee8ef62b8f3e7ce5dec0ee4f3 < cb15bb1bde0ba97cbbed9508e45210dcafec3657cb15bb1bde0ba97cbbed9508e45210dcafec3657
linuxlinux>= 5.10.234 < 5.10.2355.10.235
linuxlinux>= 5.15.177 < 5.15.1795.15.179
linuxlinux>= 5.4.290 < 5.4.2915.4.291
linuxlinux>= 5f1678346109ff3a6d229d33437fcba3cce9209d < 33eb925c0c26e86ca540a08254806512bf911f2233eb925c0c26e86ca540a08254806512bf911f22
linuxlinux>= 6.1.127 < 6.1.1306.1.130
linuxlinux>= 6.12.11 < 6.12.176.12.17
linuxlinux>= 6.6.74 < 6.6.806.6.80
linuxlinux>= 86f73d4ab2f27deeff22ba9336ad103d94f12ac7 < ff81b14010362f6188ca26fec22ff05e4da45595ff81b14010362f6188ca26fec22ff05e4da45595
linuxlinux>= bb11f992f5a475bc68ef959f17a55306f0328495 < 9d03e7e37187ae140e716377599493987fb20c5b9d03e7e37187ae140e716377599493987fb20c5b
linuxlinux>= c986380c1d5274c4d5e935addc807d6791cc23eb < 7f86fb07db65a470d0c11f79da551bd9466357dc7f86fb07db65a470d0c11f79da551bd9466357dc
linuxlinux>= eb28fd76c0a08a47b470677c6cef9dd1c60e92d1 < 37e7644b961600ef0beb01d3970c3034a62913af37e7644b961600ef0beb01d3970c3034a62913af
linuxlinux>= eb28fd76c0a08a47b470677c6cef9dd1c60e92d1 < 4ccacf86491d33d2486b62d4d44864d7101b299d4ccacf86491d33d2486b62d4d44864d7101b299d
linuxlinux>= efec287cbac92ac6ee8312a89221854760e13b34 < b70fa591b066d52b141fc430ffdee35b6cc87a66b70fa591b066d52b141fc430ffdee35b6cc87a66
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.234-15.10.234-1
linuxlinux_kernel>= 0 < 6.1.133-16.1.133-1
linuxlinux_kernel>= 0 < 6.12.17-16.12.17-1
linuxlinux_kernel>= 0 < 6.12.17-16.12.17-1

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.