Kernel Panic Vulnerability in Linux Package: IPsec Tunnel Mode Issue
Summary
DEBIAN-CVE-2025-21674: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel Attempt to enable IPsec packet offload in tunnel mode in debug kernel generates... Affects linux versions < 6.12.11-1. Fixed in 6.12.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing system resources and hardware interactions. It is widely used across various distributions and is known for its robustness and performance. However, it is also susceptible to vulnerabilities that can compromise system stability and security, such as the one identified in this report.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the net/mlx5e module, which can lead to a kernel panic when attempting to enable IPsec packet offload in tunnel mode. This issue arises from two main problems: the incorrect use of a locking mechanism during the SA (Security Association) add section and the unnecessary flush_workqueue in the SA delete routine. The vulnerability can create a deadlock scenario, leading to system instability and potential denial of service.
How To Fix
Minimum fixed version
6.12.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid enabling IPsec packet offload in tunnel mode until the package is updated to the patched version. This will prevent the kernel panic from occurring.
Conclusion
The identified vulnerability in the Linux package poses a significant risk of kernel panic when using IPsec tunnel mode. Users are advised to update to the latest patched version to mitigate this risk. Until then, avoiding the use of the affected feature is recommended.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a kernel panic caused by improper locking mechanisms in the Linux kernel's net/mlx5e module when enabling IPsec tunnel mode.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can lead to system instability, causing kernel panics and potential denial of service, impacting the overall functionality of the system.
Yes, updating the Linux package to version 6.12.11-1 or later will resolve the vulnerability.
If an immediate update is not possible, refrain from enabling IPsec packet offload in tunnel mode as a temporary workaround to avoid triggering the kernel panic.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
