CVE-2025-21766

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21766", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.762Z", "datePublished": "2025-02-27T02:18:16.570Z", "dateUpdated": "2026-10-15T21:51:52.707Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:19.559Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: use RCU protection in __ip_rt_update_pmtu()\n\n__ip_rt_update_pmtu() must use RCU protection to make\nsure the net structure it reads does not disappear."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - `__ip_rt_update_pmtu()` sits directly on the ICMP Fragmentation-Needed processing path \u2014 `icmp_rcv()` \u2192 `icmp_unreach()` \u2192 protocol err handlers (`udp_err`, `raw_err`, `ping_err`, `tcp_v4_err`, `ipip_err`, GRE/vti/esp/ah err) \u2192 `ipv4_sk_update_pmtu()`/`ipv4_update_pmtu()`. A remote host anywhere on the internet reaches it with a single crafted IPv4 ICMP packet, and the attacker-supplied `un.frag.mtu` becomes the value written into the FNHE entry.\nAC:H - The attacker fully controls the read side (unlimited ICMP frag-needed floods), but the freed `struct net` only becomes reachable when a namespace teardown races a long-lived cached `dst` whose `dst->dev` still maps to the dying netns \u2014 network-namespace destruction and the exact preemption window between loading `dev->nd_net` and dereferencing it are system state a remote attacker cannot induce.\nPR:N - No authentication or credentials are involved anywhere on the path; the tunnel error handlers (`ipip_err`, GRE, vti, esp4, ah4) and `icmp_err()` dispatch on the quoted inner header alone with no socket or peer verification, so any unauthenticated host can drive `ipv4_update_pmtu()`.\nUI:N - The ICMP error is consumed entirely inside softirq packet-receive processing; no local user opens, mounts, configures, or clicks anything for the vulnerable dereference to run.\nS:U - The use-after-free read and the resulting bogus FIB lookup and FNHE writes are all confined to the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `struct net` is not merely read for two sysctls \u2014 it is fed to `fib_lookup()`, which loads `net->ipv4.fib_main`/`fib_default`/`rules_ops` out of reclaimed memory and walks them as FIB tables and rule lists, so a groomed reallocation of the `net_cachep` object turns this into an attacker-directed read of arbitrary kernel addresses.\nI:H - `update_or_create_fnhe()` writes through the `fib_nh_common` returned by that poisoned lookup \u2014 `rcu_assign_pointer(nhc->nhc_exceptions, hash)`, `fnhe->fnhe_pmtu = pmtu`, `fnhe->fnhe_expires` \u2014 with `pmtu` taken verbatim from the attacker's `ntohs(icmph->un.frag.mtu)`, yielding a controlled write through a pointer chain rooted in freed memory.\nA:H - Even without weaponization, walking a FIB trie and a fib_rules list off a freed `struct net` reliably faults or corrupts state, producing a KASAN splat, oops, or panic, and the attacker can retrigger it indefinitely by replaying ICMP frag-needed packets."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/route.c"], "versions": [{"version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "ce3c6165fce0f06305c806696882a3ad4b90e33f", "status": "affected", "versionType": "git"}, {"version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "ea07480b23225942208f1b754fea1e7ec486d37e", "status": "affected", "versionType": "git"}, {"version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4", "status": "affected", "versionType": "git"}, {"version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "4583748b65dee4d61bd50a2214715b4237bc152a", "status": "affected", "versionType": "git"}, {"version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "a39f61d212d822b3062d7f70fa0588e50e55664e", "status": "affected", "versionType": "git"}, {"version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "139512191bd06f1b496117c76372b2ce372c9a41", "status": "affected", "versionType": "git"}, {"version": "f415c264176e6095e9dee823e09c5bdd0ee0d337", "status": "affected", "versionType": "git"}, {"version": "98776a365da509ad923083ae54b38ee521c52742", "status": "affected", "versionType": "git"}, {"version": "860e2cc78c697c95bc749abb20047239fa1722ea", "status": "affected", "versionType": "git"}, {"version": "2b1be6c925cdf4638811765a9160796291494b89", "status": "affected", "versionType": "git"}, {"version": "4.14.200", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.148", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.68", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.8.12", "lessThan": "5.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/route.c"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.79", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.16", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.4", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "5.15.179"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.1.129"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.6.79"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.12.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.13.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.200"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.68"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ce3c6165fce0f06305c806696882a3ad4b90e33f"}, {"url": "https://git.kernel.org/stable/c/ea07480b23225942208f1b754fea1e7ec486d37e"}, {"url": "https://git.kernel.org/stable/c/9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4"}, {"url": "https://git.kernel.org/stable/c/4583748b65dee4d61bd50a2214715b4237bc152a"}, {"url": "https://git.kernel.org/stable/c/a39f61d212d822b3062d7f70fa0588e50e55664e"}, {"url": "https://git.kernel.org/stable/c/139512191bd06f1b496117c76372b2ce372c9a41"}], "title": "ipv4: use RCU protection in __ip_rt_update_pmtu()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:37:21.502Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:04:14.816Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:50.331519Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:52.707Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:37:21.502Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:04:14.816Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:50.331519Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:42:50.807Z"}}], "cna": {"title": "ipv4: use RCU protection in __ip_rt_update_pmtu()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - `__ip_rt_update_pmtu()` sits directly on the ICMP Fragmentation-Needed processing path \u2014 `icmp_rcv()` \u2192 `icmp_unreach()` \u2192 protocol err handlers (`udp_err`, `raw_err`, `ping_err`, `tcp_v4_err`, `ipip_err`, GRE/vti/esp/ah err) \u2192 `ipv4_sk_update_pmtu()`/`ipv4_update_pmtu()`. A remote host anywhere on the internet reaches it with a single crafted IPv4 ICMP packet, and the attacker-supplied `un.frag.mtu` becomes the value written into the FNHE entry.\nAC:H - The attacker fully controls the read side (unlimited ICMP frag-needed floods), but the freed `struct net` only becomes reachable when a namespace teardown races a long-lived cached `dst` whose `dst->dev` still maps to the dying netns \u2014 network-namespace destruction and the exact preemption window between loading `dev->nd_net` and dereferencing it are system state a remote attacker cannot induce.\nPR:N - No authentication or credentials are involved anywhere on the path; the tunnel error handlers (`ipip_err`, GRE, vti, esp4, ah4) and `icmp_err()` dispatch on the quoted inner header alone with no socket or peer verification, so any unauthenticated host can drive `ipv4_update_pmtu()`.\nUI:N - The ICMP error is consumed entirely inside softirq packet-receive processing; no local user opens, mounts, configures, or clicks anything for the vulnerable dereference to run.\nS:U - The use-after-free read and the resulting bogus FIB lookup and FNHE writes are all confined to the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `struct net` is not merely read for two sysctls \u2014 it is fed to `fib_lookup()`, which loads `net->ipv4.fib_main`/`fib_default`/`rules_ops` out of reclaimed memory and walks them as FIB tables and rule lists, so a groomed reallocation of the `net_cachep` object turns this into an attacker-directed read of arbitrary kernel addresses.\nI:H - `update_or_create_fnhe()` writes through the `fib_nh_common` returned by that poisoned lookup \u2014 `rcu_assign_pointer(nhc->nhc_exceptions, hash)`, `fnhe->fnhe_pmtu = pmtu`, `fnhe->fnhe_expires` \u2014 with `pmtu` taken verbatim from the attacker's `ntohs(icmph->un.frag.mtu)`, yielding a controlled write through a pointer chain rooted in freed memory.\nA:H - Even without weaponization, walking a FIB trie and a fib_rules list off a freed `struct net` reliably faults or corrupts state, producing a KASAN splat, oops, or panic, and the attacker can retrigger it indefinitely by replaying ICMP frag-needed packets."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "ce3c6165fce0f06305c806696882a3ad4b90e33f", "versionType": "git"}, {"status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "ea07480b23225942208f1b754fea1e7ec486d37e", "versionType": "git"}, {"status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4", "versionType": "git"}, {"status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "4583748b65dee4d61bd50a2214715b4237bc152a", "versionType": "git"}, {"status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "a39f61d212d822b3062d7f70fa0588e50e55664e", "versionType": "git"}, {"status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "lessThan": "139512191bd06f1b496117c76372b2ce372c9a41", "versionType": "git"}, {"status": "affected", "version": "f415c264176e6095e9dee823e09c5bdd0ee0d337", "versionType": "git"}, {"status": "affected", "version": "98776a365da509ad923083ae54b38ee521c52742", "versionType": "git"}, {"status": "affected", "version": "860e2cc78c697c95bc749abb20047239fa1722ea", "versionType": "git"}, {"status": "affected", "version": "2b1be6c925cdf4638811765a9160796291494b89", "versionType": "git"}, {"status": "affected", "version": "4.14.200", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.148", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.68", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "5.8.12", "lessThan": "5.9", "versionType": "semver"}], "programFiles": ["net/ipv4/route.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"status": "unaffected", "version": "0", "lessThan": "5.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.179", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.129", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.79", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.16", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.4", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv4/route.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ce3c6165fce0f06305c806696882a3ad4b90e33f"}, {"url": "https://git.kernel.org/stable/c/ea07480b23225942208f1b754fea1e7ec486d37e"}, {"url": "https://git.kernel.org/stable/c/9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4"}, {"url": "https://git.kernel.org/stable/c/4583748b65dee4d61bd50a2214715b4237bc152a"}, {"url": "https://git.kernel.org/stable/c/a39f61d212d822b3062d7f70fa0588e50e55664e"}, {"url": "https://git.kernel.org/stable/c/139512191bd06f1b496117c76372b2ce372c9a41"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: use RCU protection in __ip_rt_update_pmtu()\n\n__ip_rt_update_pmtu() must use RCU protection to make\nsure the net structure it reads does not disappear."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.179", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.129", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.79", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.16", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.4", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.200"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.148"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.68"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.8.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:19.559Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21766", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:52.707Z", "dateReserved": "2024-12-29T08:45:45.762Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-02-27T02:18:16.570Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/route.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ce3c6165fce0f06305c806696882a3ad4b90e33f", "status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "versionType": "git"}, {"lessThan": "ea07480b23225942208f1b754fea1e7ec486d37e", "status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "versionType": "git"}, {"lessThan": "9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4", "status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "versionType": "git"}, {"lessThan": "4583748b65dee4d61bd50a2214715b4237bc152a", "status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "versionType": "git"}, {"lessThan": "a39f61d212d822b3062d7f70fa0588e50e55664e", "status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "versionType": "git"}, {"lessThan": "139512191bd06f1b496117c76372b2ce372c9a41", "status": "affected", "version": "2fbc6e89b2f1403189e624cabaf73e189c5e50c6", "versionType": "git"}, {"status": "affected", "version": "f415c264176e6095e9dee823e09c5bdd0ee0d337", "versionType": "git"}, {"status": "affected", "version": "98776a365da509ad923083ae54b38ee521c52742", "versionType": "git"}, {"status": "affected", "version": "860e2cc78c697c95bc749abb20047239fa1722ea", "versionType": "git"}, {"status": "affected", "version": "2b1be6c925cdf4638811765a9160796291494b89", "versionType": "git"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.200", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.148", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.68", "versionType": "semver"}, {"lessThan": "5.9", "status": "affected", "version": "5.8.12", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/route.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"lessThan": "5.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.179", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.129", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.79", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.16", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4C219D0-2F4C-4842-85C7-5EE4D0099F82", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.200", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "55569E66-9717-454B-B31F-EC5092EB738A", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.148", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "125ED4C1-0741-4638-BBD1-C65FD030DD95", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.68", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC0D7A36-4FCC-47E2-B6EC-E8258C72453C", "versionEndExcluding": "5.9", "versionStartIncluding": "5.8.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0F59EC9A-3D8A-4C28-A470-6CB753790F8C", "versionEndExcluding": "5.15.179", "versionStartIncluding": "5.9.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DA5009C-C9B9-4A1D-9B96-78427E8F232C", "versionEndExcluding": "6.1.129", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B16AADE5-B2FD-4C14-B4E4-85E8EDAFE775", "versionEndExcluding": "6.6.79", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "13C8DB18-FC60-425F-84E5-3EDDEC61B2FC", "versionEndExcluding": "6.12.16", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4", "versionEndExcluding": "6.13.4", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.9:-:*:*:*:*:*:*", "matchCriteriaId": "F79A2EB6-623E-4749-AEE0-DCB58C4C42F8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.9:rc7:*:*:*:*:*:*", "matchCriteriaId": "47E31D6A-31EC-4F63-9CAE-B7A52B58E149", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.9:rc8:*:*:*:*:*:*", "matchCriteriaId": "3497462B-A3DA-47CC-A5DD-C1C2D2E6DFDE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*", "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: use RCU protection in __ip_rt_update_pmtu()\n\n__ip_rt_update_pmtu() must use RCU protection to make\nsure the net structure it reads does not disappear."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipv4: usar protecci\u00f3n RCU en __ip_rt_update_pmtu() __ip_rt_update_pmtu() debe usar protecci\u00f3n RCU para asegurarse de que la estructura de red que lee no desaparezca."}], "id": "CVE-2025-21766", "lastModified": "2026-10-15T22:18:08.290", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21766", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:42:50.331519Z", "version": "2.0.3"}}]}, "published": "2025-02-27T03:15:17.273", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/139512191bd06f1b496117c76372b2ce372c9a41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4583748b65dee4d61bd50a2214715b4237bc152a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a39f61d212d822b3062d7f70fa0588e50e55664e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ce3c6165fce0f06305c806696882a3ad4b90e33f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea07480b23225942208f1b754fea1e7ec486d37e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ipv4: use RCU protection in __ip_rt_update_pmtu()", "id": "2348632", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348632"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv4: use RCU protection in __ip_rt_update_pmtu()\n__ip_rt_update_pmtu() must use RCU protection to make\nsure the net structure it reads does not disappear."], "name": "CVE-2025-21766", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21766\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21766\nhttps://lore.kernel.org/linux-cve-announce/2025022605-CVE-2025-21766-a004@gregkh/T"], "threat_severity": "Low"}

{}