In the Linux kernel, the following vulnerability has been resolved:
vrf: use RCU protection in l3mdevl3out()
l3mdevl3out() can be called without RCU being held:
rawsendmsg() ippushpendingframes() ipsendskb() iplocalout() _iplocalout() l3mdevip_out()
Add rcureadlock() / rcureadunlock() pair to avoid a potential UAF.
[
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h"
},
"digest": {
"line_hashes": [
"107208704649491196358452794328158964458",
"276137777644675375789914513887730812489",
"162089123932843439311896780097610966867",
"140399105648507270582492504766315266746",
"163142976169522113577296466425228563475",
"269535710343780144784310585133459472440",
"47555233308614083414549057075439542204"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022cac1c693add610ae76ede03adf4d9d5a2cf21",
"signature_version": "v1",
"id": "CVE-2025-21791-0ecd231e"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h"
},
"digest": {
"line_hashes": [
"107208704649491196358452794328158964458",
"276137777644675375789914513887730812489",
"162089123932843439311896780097610966867",
"140399105648507270582492504766315266746",
"163142976169522113577296466425228563475",
"269535710343780144784310585133459472440",
"47555233308614083414549057075439542204"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b81425b517accefd46bee854d94954f5c57e019",
"signature_version": "v1",
"id": "CVE-2025-21791-0f6ad902"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h",
"function": "l3mdev_l3_out"
},
"digest": {
"length": 322.0,
"function_hash": "104638040537260607862250710885018695332"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20a3489b396764cc9376e32a9172bee26a89dc3b",
"signature_version": "v1",
"id": "CVE-2025-21791-10ae96ae"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h",
"function": "l3mdev_l3_out"
},
"digest": {
"length": 322.0,
"function_hash": "104638040537260607862250710885018695332"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0ce46a93135d96b7fa075a94a88fe0da8e8773",
"signature_version": "v1",
"id": "CVE-2025-21791-146caf8d"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h"
},
"digest": {
"line_hashes": [
"107208704649491196358452794328158964458",
"276137777644675375789914513887730812489",
"162089123932843439311896780097610966867",
"140399105648507270582492504766315266746",
"163142976169522113577296466425228563475",
"269535710343780144784310585133459472440",
"47555233308614083414549057075439542204"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bb4228c32261d06e4fbece37ec3828bcc005b6b",
"signature_version": "v1",
"id": "CVE-2025-21791-17cddf13"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h",
"function": "l3mdev_l3_out"
},
"digest": {
"length": 322.0,
"function_hash": "104638040537260607862250710885018695332"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c40cb5c03e37552d6eff963187109e2c3f78ef6f",
"signature_version": "v1",
"id": "CVE-2025-21791-49312523"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h"
},
"digest": {
"line_hashes": [
"107208704649491196358452794328158964458",
"276137777644675375789914513887730812489",
"162089123932843439311896780097610966867",
"140399105648507270582492504766315266746",
"163142976169522113577296466425228563475",
"269535710343780144784310585133459472440",
"47555233308614083414549057075439542204"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20a3489b396764cc9376e32a9172bee26a89dc3b",
"signature_version": "v1",
"id": "CVE-2025-21791-58d1f911"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h",
"function": "l3mdev_l3_out"
},
"digest": {
"length": 322.0,
"function_hash": "104638040537260607862250710885018695332"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bb4228c32261d06e4fbece37ec3828bcc005b6b",
"signature_version": "v1",
"id": "CVE-2025-21791-5e868588"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h"
},
"digest": {
"line_hashes": [
"107208704649491196358452794328158964458",
"276137777644675375789914513887730812489",
"162089123932843439311896780097610966867",
"140399105648507270582492504766315266746",
"163142976169522113577296466425228563475",
"269535710343780144784310585133459472440",
"47555233308614083414549057075439542204"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c40cb5c03e37552d6eff963187109e2c3f78ef6f",
"signature_version": "v1",
"id": "CVE-2025-21791-87fc434f"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h",
"function": "l3mdev_l3_out"
},
"digest": {
"length": 322.0,
"function_hash": "104638040537260607862250710885018695332"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b81425b517accefd46bee854d94954f5c57e019",
"signature_version": "v1",
"id": "CVE-2025-21791-9ff9ff47"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h",
"function": "l3mdev_l3_out"
},
"digest": {
"length": 322.0,
"function_hash": "104638040537260607862250710885018695332"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ccaa5797f5362a2aad6baa6ddaf4715ac2dd51e",
"signature_version": "v1",
"id": "CVE-2025-21791-c3711952"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h"
},
"digest": {
"line_hashes": [
"107208704649491196358452794328158964458",
"276137777644675375789914513887730812489",
"162089123932843439311896780097610966867",
"140399105648507270582492504766315266746",
"163142976169522113577296466425228563475",
"269535710343780144784310585133459472440",
"47555233308614083414549057075439542204"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0ce46a93135d96b7fa075a94a88fe0da8e8773",
"signature_version": "v1",
"id": "CVE-2025-21791-c97c1eb3"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h",
"function": "l3mdev_l3_out"
},
"digest": {
"length": 322.0,
"function_hash": "104638040537260607862250710885018695332"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022cac1c693add610ae76ede03adf4d9d5a2cf21",
"signature_version": "v1",
"id": "CVE-2025-21791-dcfb7fa4"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h"
},
"digest": {
"line_hashes": [
"107208704649491196358452794328158964458",
"276137777644675375789914513887730812489",
"162089123932843439311896780097610966867",
"140399105648507270582492504766315266746",
"163142976169522113577296466425228563475",
"269535710343780144784310585133459472440",
"47555233308614083414549057075439542204"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7574740be8ce68a57d0aece24987b9be2114c3c",
"signature_version": "v1",
"id": "CVE-2025-21791-e32f0e14"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h"
},
"digest": {
"line_hashes": [
"107208704649491196358452794328158964458",
"276137777644675375789914513887730812489",
"162089123932843439311896780097610966867",
"140399105648507270582492504766315266746",
"163142976169522113577296466425228563475",
"269535710343780144784310585133459472440",
"47555233308614083414549057075439542204"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ccaa5797f5362a2aad6baa6ddaf4715ac2dd51e",
"signature_version": "v1",
"id": "CVE-2025-21791-f93abdb8"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "include/net/l3mdev.h",
"function": "l3mdev_l3_out"
},
"digest": {
"length": 322.0,
"function_hash": "104638040537260607862250710885018695332"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7574740be8ce68a57d0aece24987b9be2114c3c",
"signature_version": "v1",
"id": "CVE-2025-21791-faa4fa49"
}
]