ACK: [SRU][J][PATCH 0/1] CVE-2025-21759

[Andrei Gherzan]

On 26/09/09 06:04AM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-21759
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> ipv6: mcast: extend RCU protection in igmp6_send()
> 
> igmp6_send() can be called without RTNL or RCU being held.
> 
> Extend RCU protection so that we can safely fetch the net pointer and avoid a
> potential UAF.
> 
> Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses
> GFP_KERNEL allocations which can sleep.
> 
> Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU
> protection.
> 
> [ Fix ]
> 
> jammy/linux: backported from 087c1faa594f
> 
> The backport keeps this tree's statistics accounting: the counter moved under
> RCU protection remains IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len)
> as present in jammy, rather than upstream's IP6_INC_STATS() with
> IPSTATS_MIB_OUTREQUESTS. This is the only deviation from the upstream commit
> and does not change the functional behaviour of the fix.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> The change touches the IPv6 multicast listener (MLD) transmit path, so any
> regression would most likely appear on systems that generate IPv6 multicast
> report and query traffic, such as hosts on IPv6-enabled networks, routers, and
> multicast-heavy workloads. Because the allocation now uses alloc_skb() with
> explicit socket charging instead of sock_alloc_send_skb(), a mistake in the
> memory accounting or RCU sections could affect MLD packet transmission or
> socket buffer accounting under load. Systems without IPv6 or without IPv6
> multicast activity are not affected.
> 
> [ Other Info ]
> 
> Kybele flow-v11-21-g0f091652. Reference: 51b52e02/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260911/04c55706/attachment-0001.sig>