TCP Secpath Reference Leak in Linux Kernel - CVE-2025-21864
Summary
CVE-2025-21864: In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down... Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources and facilitates communication between applications and hardware. This vulnerability affects the TCP stack within the kernel, specifically related to the handling of security paths (secpath) during network namespace deletions.
Vulnerability Detail
CVE-2025-21864 is a vulnerability in the Linux kernel that arises when a TCP connection's security path reference is not properly released during the deletion of a network namespace. This can lead to a lingering reference on an xfrm_state, which may cause unexpected behavior or crashes. The issue occurs when an skb (socket buffer) is deferred for freeing without flushing the associated security path, resulting in a potential resource leak and instability in the network stack.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-21864 is a significant vulnerability in the Linux kernel that requires prompt attention. Users are advised to update their systems to the latest patched versions to ensure stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21864 is a vulnerability in the Linux kernel related to improper handling of TCP secpath references during network namespace deletions.
This vulnerability can lead to resource leaks and potential crashes in the network stack, affecting system stability and performance.
If you are using Debian 12 or 13, your system may be affected. Check your current Linux version and update to the patched version if necessary.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit https://vulert.com for more information.
While there are no specific workarounds available, it is crucial to monitor for updates and apply them as soon as they are released to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.