In the Linux kernel, the following vulnerability has been resolved:
net/ipv6: release expired exception dst cached in socket
Dst objects get leaked in ip6_negative_advice() when this function is executed for an expired IPv6 route located in the exception table. There are several conditions that must be fulfilled for the leak to occur: * an ICMPv6 packet indicating a change of the MTU for the path is received, resulting in an exception dst being created * a TCP connection that uses the exception dst for routing packets must start timing out so that TCP begins retransmissions * after the exception dst expires, the FIB6 garbage collector must not run before TCP executes ip6_negative_advice() for the expired exception dst
When TCP executes ip6_negative_advice() for an exception dst that has expired and if no other socket holds a reference to the exception dst, the refcount of the exception dst is 2, which corresponds to the increment made by dst_init() and the increment made by the TCP socket for which the connection is timing out. The refcount made by the socket is never released. The refcount of the dst is decremented in sk_dst_reset() but that decrement is counteracted by a dst_hold() intentionally placed just before the sk_dst_reset() in ip6_negative_advice(). After ip6_negative_advice() has finished, there is no other object tied to the dst. The socket lost its reference stored in sk_dst_cache and the dst is no longer in the exception table. The exception dst becomes a leaked object.
As a result of this dst leak, an unbalanced refcount is reported for the loopback device of a net namespace being destroyed under kernels that do not contain e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev"): unregister_netdevice: waiting for lo to become free. Usage count = 2
Fix the dst leak by removing the dst_hold() in ip6_negative_advice(). The patch that introduced the dst_hold() in ip6_negative_advice() was 92f1655aa2b22 ("net: fix __dst_negative_advice() race"). But 92f1655aa2b22 merely refactored the code with regards to the dst refcount so the issue was present even before 92f1655aa2b22. The bug was introduced in 54c1a859efd9f ("ipv6: Don't drop cache route entry unless timer actually expired.") where the expired cached route is deleted and the sk_dst_cache member of the socket is set to NULL by calling dst_negative_advice() but the refcount belonging to the socket is left unbalanced.
The IPv4 version - ipv4_negative_advice() - is not affected by this bug. When the TCP connection times out ipv4_negative_advice() merely resets the sk_dst_cache of the socket while decrementing the refcount of the exception dst.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.233-223.887Upgrade python-perf-debuginfoUpgrade perfUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.176-118.170Upgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-develUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-devel | Mar 14, 2025 | Dec 27, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpfUpgrade kernel-develUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade python3-perfUpgrade kernel-tools-develUpgrade perfUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.124-134.200Upgrade kernel-libbpf-staticUpgrade kernel-debuginfoUpgrade kernel-libbpf-develUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel | Mar 27, 2025 | Dec 27, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jan 13, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade python3-perf | Apr 11, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | May 7, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade python3-perf | Jun 11, 2025 | Dec 27, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Jan 13, 2025 | Dec 27, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | May 15, 2025 | Dec 27, 2024 |
| Rocky_linux | — | Upgrade perf-debuginfoUpgrade python3-perfUpgrade perfUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-coreUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-cross-headersUpgrade bpftool-debuginfoUpgrade kernelUpgrade bpftoolUpgrade kernel-headersUpgrade kernel-modulesUpgrade kernel-debug-core | Feb 5, 2026 | Sep 8, 2025 |
| Ubuntu | — | Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.11.0-21-genericUpgrade linux-image-genericUpgrade linux-image-intelUpgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-gke-5.15Upgrade linux-image-gcp-fipsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.11.0-1012-azureUpgrade linux-image-azure-lts-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-azure-fipsUpgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-nvidia-tegraUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-20.04dUpgrade linux-image-oem-24.04aUpgrade linux-image-fipsUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-azure-lts-22.04Upgrade linux-image-6.11.0-1011-awsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-5.15.0-1086-azureUpgrade linux-image-6.8.0-58-genericUpgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.15.0-135-fipsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-azureUpgrade linux-image-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1084-azureUpgrade linux-image-raspi2Upgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-oem-22.04aUpgrade linux-image-raspiUpgrade linux-image-oem-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-5.15.0-136-generic-64kUpgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-5.15.0-136-genericUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-azure-nvidiaUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-ibm-classicUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-ibmUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-6.8.0-1026-oemUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-aws-fipsUpgrade linux-image-gkeUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1142-awsUpgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-awsUpgrade linux-image-kvmUpgrade linux-image-nvidia-64kUpgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-20.04Upgrade linux-image-oemUpgrade linux-image-intel-iotgUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-azure-cvmUpgrade linux-image-virtualUpgrade linux-image-oracle-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-raspi-nolpaeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-58-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-bluefieldUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1027-azureUpgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-5.15.0-1080-awsUpgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-gcp-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-realtimeUpgrade linux-image-oem-osp1Upgrade linux-image-oem-24.04bUpgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-135-genericUpgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-1088-ibm | Mar 28, 2025 | Dec 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub