CVE-2025-21864

Summary

CVE-2025-21864 is a vulnerability in the Linux kernel that affects the TCP component. The issue arises when a pair of netns is created and deleted, while a basic TCP test over ipcomp6 is run in between. During this process, an xfrm_state is not deleted when the netns is, leading to a lingering reference on the xfrm_state. This reference is held by a secpath, which is still attached to an skb that ends up on the sk_receive_queue and is eventually defer-free'd. The problem occurs when the skb's dst is dropped in the TCP receive path, but the secpath is not, which can lead to unexpected references to the xfrm_state. To mitigate this vulnerability, the Linux kernel has been updated to also drop the secpath when the netns and skb are deleted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.