CVE-2025-21766
ipv4: use RCU protection in __ip_rt_update_pmtu()
MEDIUM
5.5
CVSS Score
Published: February 27, 2025 at 02:18 AM UTC
Updated: October 15, 2026 at 10:18 PM UTC
4 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 CPU 1518-4 Pn /dp MFP FirmwareSiplus S7-1500 CPU 1518-4 Pn /dp MFP Firmware
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.6%
SSVC
No known exploit
Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: use RCU protection in __ip_rt_update_pmtu() __ip_rt_update_pmtu() must use RCU protection to make sure the net structure it reads does not disappear.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
4.14.200 ≤ v < 4.154.19.148 ≤ v < 4.205.16 ≤ v < 6.1.1295.4.68 ≤ v < 5.55.8.12 ≤ v < 5.95.9.1 ≤ v < 5.15.1796.13 ≤ v < 6.13.46.2 ≤ v < 6.6.796.7 ≤ v < 6.12.162b1be6c925cdf4638811765a9160796291494b892fbc6e89b2f1403189e624cabaf73e189c5e50c64.14.2004.19.1485.4.685.8.125.95.9 rc75.9 rc86.146.14 rc16.14 rc2860e2cc78c697c95bc749abb20047239fa1722ea98776a365da509ad923083ae54b38ee521c52742f415c264176e6095e9dee823e09c5bdd0ee0d337
Vendor states this is fixed in 139512191bd06f1b496117c76372b2ce372c9a41 (fixed)
Vendor states this is fixed in 4583748b65dee4d61bd50a2214715b4237bc152a (fixed)
Vendor states this is fixed in 9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4 (fixed)
Vendor states this is fixed in a39f61d212d822b3062d7f70fa0588e50e55664e (fixed)
Vendor states this is fixed in ce3c6165fce0f06305c806696882a3ad4b90e33f (fixed)
Vendor states this is fixed in ea07480b23225942208f1b754fea1e7ec486d37e (fixed)
Affected range stops below 4.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.20, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.15.179 (unaffected)
Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.9 (unaffected)
Vendor states this is fixed in 6.1.129 (unaffected)
Vendor states this is fixed in 6.12.16 (unaffected)
Vendor states this is fixed in 6.13.4 (unaffected)
Vendor states this is fixed in 6.14 (unaffected)
Vendor states this is fixed in 6.6.79 (unaffected)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/139512191bd06f1b496117c76372b2ce372c9a41
- https://git.kernel.org/stable/c/4583748b65dee4d61bd50a2214715b4237bc152a
- https://git.kernel.org/stable/c/9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4
- https://git.kernel.org/stable/c/a39f61d212d822b3062d7f70fa0588e50e55664e
- https://git.kernel.org/stable/c/ce3c6165fce0f06305c806696882a3ad4b90e33f
References (9)
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/139512191bd06f1b496117c76372b2ce372c9a41Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4583748b65dee4d61bd50a2214715b4237bc152aPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a39f61d212d822b3062d7f70fa0588e50e55664ePatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ce3c6165fce0f06305c806696882a3ad4b90e33fPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ea07480b23225942208f1b754fea1e7ec486d37eSource: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlSource: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlSSVC — Action Prioritization
SSVCNo known exploitNot automatableTotal impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
NVD-CWE-noinfo
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card