GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21972 (GCVE-0-2025-21972)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:47 – Updated: 2026-08-05 11:55
VLAI
Title
net: mctp: unshare packets when reassembling
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mctp: unshare packets when reassembling Ensure that the frag_list used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and prevents a memory leak due to circular references between fragments and their skb_shared_info. The upcoming MCTP-over-USB driver uses skb_clone which can trigger the problem - other MCTP drivers don't share SKBs. A kunit test is added to reproduce the issue.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4a992bbd365094730a31bae1e12a6ca695336d57 , < 5c47d5bfa7b096cf8890afac32141c578583f8e0 (git)
Affected: 4a992bbd365094730a31bae1e12a6ca695336d57 , < f44fff3d3c6cd67b6f348b821d73c4d6888c7a6e (git)
Affected: 4a992bbd365094730a31bae1e12a6ca695336d57 , < f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.12.20 , ≤ 6.12.* (semver)
Unaffected: 6.13.8 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mctp/route.c",
            "net/mctp/test/route-test.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c47d5bfa7b096cf8890afac32141c578583f8e0",
              "status": "affected",
              "version": "4a992bbd365094730a31bae1e12a6ca695336d57",
              "versionType": "git"
            },
            {
              "lessThan": "f44fff3d3c6cd67b6f348b821d73c4d6888c7a6e",
              "status": "affected",
              "version": "4a992bbd365094730a31bae1e12a6ca695336d57",
              "versionType": "git"
            },
            {
              "lessThan": "f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc",
              "status": "affected",
              "version": "4a992bbd365094730a31bae1e12a6ca695336d57",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mctp/route.c",
            "net/mctp/test/route-test.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp: unshare packets when reassembling\n\nEnsure that the frag_list used for reassembly isn\u0027t shared with other\npackets. This avoids incorrect reassembly when packets are cloned, and\nprevents a memory leak due to circular references between fragments and\ntheir skb_shared_info.\n\nThe upcoming MCTP-over-USB driver uses skb_clone which can trigger the\nproblem - other MCTP drivers don\u0027t share SKBs.\n\nA kunit test is added to reproduce the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable code is a network-stack packet handler (`ETH_P_MCTP` packet_type \u2192 `mctp_route_input`), but MCTP has no internet-routable transport in the kernel \u2014 packets arrive from a device on the local management bus (SMBus/I2C, I3C, USB, serial), a limited administrative domain directly analogous to the Bluetooth/WiFi case.\nAC:L - The attacker fully controls both preconditions: sending a multi-packet (SOM/EOM) fragmented message, and causing the skbs to be clones by packing several MCTP packets into a single transfer (`mctp-usb.c:219`). No race, memory-layout dependency, or victim state is involved, and the kunit reproducer added by the fix triggers it deterministically.\nPR:N - There is no authentication or authorization anywhere on the path from `mctp_pkttype_receive()` to `mctp_frag_queue()` \u2014 MCTP packets are parsed and reassembled purely on header contents, so a device on the bus needs no credentials or local account.\nUI:N - Reassembly happens in softirq context on packet receive; no user action is needed on the victim system beyond having MCTP configured, which is the normal state for the affected BMC/host management deployments.\nS:U - The corruption and its consequences are confined to kernel skb structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing the reassembly `frag_list` into a shared `skb_shared_info` cross-links skbs belonging to different reassembly contexts and to other subsystems (e.g. AF_PACKET clones), so a socket can be delivered a fragment chain from an unrelated message with mismatched length accounting \u2014 memory-state corruption leveragable for disclosure of data from another context.\nI:H - The bug both delivers incorrectly reassembled message content to MCTP sockets (corrupting PLDM/NVMe-MI/NC-SI management traffic) and plants an attacker-influenced skb pointer into a `skb_shared_info` owned by other subsystems, which is later dereferenced and freed by an owner that never expected a fragment list.\nA:H - Every cloned fragmented message permanently leaks its skbs and backing data buffer through the circular `frag_list`/`dataref` reference, and the attacker can repeat this without limit \u2014 driving memory exhaustion and OOM/kernel failure on the memory-constrained BMC and embedded systems where MCTP is deployed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:47.567Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c47d5bfa7b096cf8890afac32141c578583f8e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f44fff3d3c6cd67b6f348b821d73c4d6888c7a6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc"
        }
      ],
      "title": "net: mctp: unshare packets when reassembling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21972",
    "datePublished": "2025-04-01T15:47:04.960Z",
    "dateReserved": "2024-12-29T08:45:45.797Z",
    "dateUpdated": "2026-08-05T11:55:47.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21972",
      "date": "2026-09-16",
      "epss": "0.00229",
      "percentile": "0.13852"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-04T01:32:13.000Z",
      "cve": "CVE-2025-21972",
      "id": "msrc_CVE-2025-21972",
      "initial_release_date": "2025-04-02T00:00:00.000Z",
      "product_status:known_not_affected": "2",
      "product_status:under_investigation": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: mctp: unshare packets when reassembling",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21972.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21972\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:28.540\",\"lastModified\":\"2026-07-30T06:22:01.147\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: mctp: unshare packets when reassembling\\n\\nEnsure that the frag_list used for reassembly isn\u0027t shared with other\\npackets. This avoids incorrect reassembly when packets are cloned, and\\nprevents a memory leak due to circular references between fragments and\\ntheir skb_shared_info.\\n\\nThe upcoming MCTP-over-USB driver uses skb_clone which can trigger the\\nproblem - other MCTP drivers don\u0027t share SKBs.\\n\\nA kunit test is added to reproduce the issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: mctp: paquetes no compartidos al reensamblar. Aseg\u00farese de que la lista de fragmentos utilizada para el reensamblado no se comparta con otros paquetes. Esto evita un reensamblado incorrecto al clonar paquetes y previene una fuga de memoria debido a referencias circulares entre fragmentos y su skb_shared_info. El pr\u00f3ximo controlador MCTP sobre USB utiliza skb_clone, lo que puede desencadenar el problema; otros controladores MCTP no comparten los SKB. Se ha a\u00f1adido una prueba kunit para reproducir el problema.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mctp/route.c\",\"net/mctp/test/route-test.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4a992bbd365094730a31bae1e12a6ca695336d57\",\"lessThan\":\"5c47d5bfa7b096cf8890afac32141c578583f8e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a992bbd365094730a31bae1e12a6ca695336d57\",\"lessThan\":\"f44fff3d3c6cd67b6f348b821d73c4d6888c7a6e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a992bbd365094730a31bae1e12a6ca695336d57\",\"lessThan\":\"f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mctp/route.c\",\"net/mctp/test/route-test.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.20\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.8\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"6.12.20\",\"matchCriteriaId\":\"E2FE0CCC-2753-4E67-9835-56B5FA61F48D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.8\",\"matchCriteriaId\":\"0A20D4D7-B329-4C68-B662-76062EA7DCF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1759FFB7-531C-41B1-9AE1-FD3D80E0D920\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5c47d5bfa7b096cf8890afac32141c578583f8e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f44fff3d3c6cd67b6f348b821d73c4d6888c7a6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:30:32+00:00",
      "cve": "CVE-2025-21972",
      "id": "CVE-2025-21972",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: mctp: unshare packets when reassembling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21972.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:52:16Z",
      "cve": "CVE-2025-21972",
      "id": "CVE-2025-21972",
      "initial_release_date": "2025-04-02T08:57:13Z",
      "product_status:known_affected": "437",
      "product_status:known_not_affected": "384",
      "product_status:recommended": "384",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21972",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21972.json",
      "version": "48"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.