CVE-2025-22005

ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().

MEDIUM

5.5

CVSS Score

Published: April 3, 2025 at 07:19 AM UTC

Updated: October 15, 2026 at 02:17 AM UTC

4 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 CPU 1518-4 Pn /dp MFP FirmwareSiplus S7-1500 CPU 1518-4 Pn /dp MFP Firmware

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything when it fails. Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init() but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak. Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the error path. Note that we can remove the fib6_nh_release() call in nh_create_ipv6() later in net-next.git.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.16 ≤ v < 6.1.1325.3 ≤ v < 5.4.2925.5 ≤ v < 5.10.2366.13 ≤ v < 6.13.96.2 ≤ v < 6.6.856.7 ≤ v < 6.12.216.14 6.14 rc1 6.14 rc2 6.14 rc3 6.14 rc4 6.14 rc5 6.14 rc6 6.14 rc77dd73168e273938b9e9bb42ca51b0c27d807992b

Vendor states this is fixed in 119dcafe36795a15ae53351cbbd6177aaf94ffef (fixed)

Vendor states this is fixed in 16267a5036173d0173377545b4b6021b081d0933 (fixed)

Vendor states this is fixed in 1bd12dfc058e1e68759d313d7727d68dbc1b8964 (fixed)

Vendor states this is fixed in 29d91820184d5cbc70f3246d4911d96eaeb930d6 (fixed)

Vendor states this is fixed in 596a883c4ce2d2e9c175f25b98fed3a1f33fea38 (fixed)

Vendor states this is fixed in 77c41cdbe6bce476e08d3251c0d501feaf10a9f3 (fixed)

Vendor states this is fixed in 9740890ee20e01f99ff1dde84c63dcf089fabb98 (fixed)

Vendor states this is fixed in d3d5b4b5ae263c3225db363ba08b937e2e2b0380 (fixed)

Vendor states this is fixed in 5.10.236 (unaffected)

Vendor states this is fixed in 5.15.180 (unaffected)

Vendor states this is fixed in 5.3 (unaffected)

Vendor states this is fixed in 5.4.292 (unaffected)