[SRU][J][PATCH 0/1] CVE-2025-21759

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-21759

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: extend RCU protection in igmp6_send()

igmp6_send() can be called without RTNL or RCU being held.

Extend RCU protection so that we can safely fetch the net pointer and avoid a
potential UAF.

Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses
GFP_KERNEL allocations which can sleep.

Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU
protection.

[ Fix ]

jammy/linux: backported from 087c1faa594f

The backport keeps this tree's statistics accounting: the counter moved under
RCU protection remains IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len)
as present in jammy, rather than upstream's IP6_INC_STATS() with
IPSTATS_MIB_OUTREQUESTS. This is the only deviation from the upstream commit
and does not change the functional behaviour of the fix.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

The change touches the IPv6 multicast listener (MLD) transmit path, so any
regression would most likely appear on systems that generate IPv6 multicast
report and query traffic, such as hosts on IPv6-enabled networks, routers, and
multicast-heavy workloads. Because the allocation now uses alloc_skb() with
explicit socket charging instead of sock_alloc_send_skb(), a mistake in the
memory accounting or RCU sections could affect MLD packet transmission or
socket buffer accounting under load. Systems without IPv6 or without IPv6
multicast activity are not affected.

[ Other Info ]

Kybele flow-v11-21-g0f091652. Reference: 51b52e02/v1