In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix memleak of nhcpcpurthoutput in fibchecknhv6_gw().
fibchecknhv6gw() expects that fib6nhinit() cleans up everything when it fails.
Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6nh") moved fibnhcommoninit() before allocpercpugfp() within fib6nhinit() but forgot to add cleanup for fib6nh->nhcommon.nhcpcpurthoutput in case it fails to allocate fib6nh->rt6i_pcpu, resulting in memleak.
Let's call fibnhcommonrelease() and clear nhcpcpurthoutput in the error path.
Note that we can remove the fib6nhrelease() call in nhcreateipv6() later in net-next.git.
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"178187642252968961619650435106176112613",
"331754963269561159871337280247929911025",
"149127237763579250331288641875014623800",
"210713610720029046038947909533351913993"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16267a5036173d0173377545b4b6021b081d0933",
"target": {
"file": "net/ipv6/route.c"
},
"id": "CVE-2025-22005-4d3b9eea"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"178187642252968961619650435106176112613",
"331754963269561159871337280247929911025",
"3088718382648876309173696592418825960",
"184609717889866676676110063047093301152"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3d5b4b5ae263c3225db363ba08b937e2e2b0380",
"target": {
"file": "net/ipv6/route.c"
},
"id": "CVE-2025-22005-801f888c"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2471.0,
"function_hash": "218265568875545901204531635836024715719"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3d5b4b5ae263c3225db363ba08b937e2e2b0380",
"target": {
"file": "net/ipv6/route.c",
"function": "fib6_nh_init"
},
"id": "CVE-2025-22005-8310a629"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"178187642252968961619650435106176112613",
"331754963269561159871337280247929911025",
"213266765380318648067154810717484071373",
"182827368364931382923953718546577747827"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@596a883c4ce2d2e9c175f25b98fed3a1f33fea38",
"target": {
"file": "net/ipv6/route.c"
},
"id": "CVE-2025-22005-cafebb64"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2379.0,
"function_hash": "314344453285527627393745475770189834146"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@596a883c4ce2d2e9c175f25b98fed3a1f33fea38",
"target": {
"file": "net/ipv6/route.c",
"function": "fib6_nh_init"
},
"id": "CVE-2025-22005-ea0166a0"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2258.0,
"function_hash": "4238682421156610885505044516356137634"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16267a5036173d0173377545b4b6021b081d0933",
"target": {
"file": "net/ipv6/route.c",
"function": "fib6_nh_init"
},
"id": "CVE-2025-22005-f96d4071"
}
]