GHSA-qpwf-m697-v547 · 深刻度： medium — In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the...
In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to: - create a pair of netns - run a basic TCP test over ipcomp6 - delete the pair of netns The xfrm_state found on spi_byaddr was not deleted at the time we delete the netns, because we still have a reference on it. This lingering reference comes from a secpath (which holds a ref on the xfrm_state), which is still attached to an skb. This skb is not leaked, it ends up on sk_receive_queue and then gets defer-free'd by skb_attempt_defer_free. The problem happens when we defer freeing an skb (push it on one CPU's defer_list), and don't flush that list before the netns is deleted. In that case, we still have a reference on the xfrm_state that we don't expect at this point. We already drop the skb's dst in the TCP receive path when it's no longer needed, so let's also drop the secpath. At this point, tcp_filter has already called into the LSM hooks that may require the secpath, so it should not be needed anymore. However, in some of those places, the MPTCP extension has just been attached to the skb, so we cannot simply drop all extensions.
総合評価: CVE-2025-21864 は低リスク（25.7/100）。CVSS 深刻度は中。悪用される可能性が高い（EPSS 0.20%、10 パーセンタイル） 推奨対応: 悪用情報と EPSS の推移を監視し、必要に応じて優先度を見直してください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.01% | 0.20% | +0.18% |
| 2 | 2026-04-20 | 0.05% | 0.01% | -0.04% |
| 3 | 2026-01-06 | — | 0.05% | — |
EPSS の全履歴 （全 6 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 5.5 | 3.1 | MEDIUM |
|
1.8 | 3.6 | [email protected] |
| 5.5 | 3.1 | MEDIUM |
|
1.8 | 3.6 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
GHSA-qpwf-m697-v547 · 深刻度： medium — In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the...
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
unimportant | CVE-2025-21864 unimportant priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6. | https://security-tracker.debian.org/tracker/CVE-2025-21864 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2025-21864 |
suse
|
medium | — | https://www.suse.com/security/cve/CVE-2025-21864/ |
ubuntu
|
medium | CVE-2025-21864 medium priority: Ubuntu including 150 source packages (linux, linux-allwinner-5.19, …), 1487 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1097, ignored 150, released 127, not-affected 113. | https://ubuntu.com/security/CVE-2025-21864 |
| ベンダー | 製品 | バージョン | 生の CPE |
|---|---|---|---|
| linux | linux_kernel | >= 5.19, < 6.1.130 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.2, < 6.6.80 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.7, < 6.12.17 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.13, < 6.13.5 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | 6.14 | cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:* |
| linux | linux_kernel | 6.14 | cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:* |
| linux | linux_kernel | 6.14 | cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:* |