ACK: [SRU][J][PATCH 0/1] CVE-2025-21759

[Edoardo Canepa]

Acked-by: Edoardo Canepa <edoardo.canepa at canonical.com>

On 9/9/26 08:04, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-21759
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> ipv6: mcast: extend RCU protection in igmp6_send()
>
> igmp6_send() can be called without RTNL or RCU being held.
>
> Extend RCU protection so that we can safely fetch the net pointer and avoid a
> potential UAF.
>
> Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses
> GFP_KERNEL allocations which can sleep.
>
> Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU
> protection.
>
> [ Fix ]
>
> jammy/linux: backported from 087c1faa594f
>
> The backport keeps this tree's statistics accounting: the counter moved under
> RCU protection remains IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len)
> as present in jammy, rather than upstream's IP6_INC_STATS() with
> IPSTATS_MIB_OUTREQUESTS. This is the only deviation from the upstream commit
> and does not change the functional behaviour of the fix.
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> The change touches the IPv6 multicast listener (MLD) transmit path, so any
> regression would most likely appear on systems that generate IPv6 multicast
> report and query traffic, such as hosts on IPv6-enabled networks, routers, and
> multicast-heavy workloads. Because the allocation now uses alloc_skb() with
> explicit socket charging instead of sock_alloc_send_skb(), a mistake in the
> memory accounting or RCU sections could affect MLD packet transmission or
> socket buffer accounting under load. Systems without IPv6 or without IPv6
> multicast activity are not affected.
>
> [ Other Info ]
>
> Kybele flow-v11-21-g0f091652. Reference: 51b52e02/v1
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260914/eecb115b/attachment.sig>