Kernel Panic Vulnerability in Linux Package: xfrm secpath Handling Issue
Summary
DEBIAN-CVE-2025-21720: In the Linux kernel, the following vulnerability has been resolved: xfrm: delete intermediate secpath entry in packet offload mode Packets handled by hardware have added secpath as a way to inform XFRM core code that thi... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing hardware and software interactions. It provides essential functionalities such as process management, memory management, and device control. This vulnerability arises from improper handling of security paths (secpath) in packet offload mode, particularly affecting systems with IP forwarding enabled.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of intermediate secpath entries in packet offload mode. When packets are processed by hardware, they are marked with secpath to indicate that they have been handled. However, if IP forwarding is enabled, the secpath is not removed as intended, leading to a situation where packets that have already been processed re-enter the driver TX path with the xfrm_offload flag set. This can result in a kernel panic, specifically a NULL pointer dereference, causing system instability and crashes.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable IP forwarding by executing the command 'echo 0 > /proc/sys/net/ipv4/ip_forward'. This will prevent the conditions that lead to the vulnerability until the package can be updated.
Conclusion
The vulnerability in the Linux kernel related to secpath handling poses significant risks, particularly for systems with IP forwarding enabled. Users are advised to update their packages to the latest version to ensure system stability and security. Temporary workarounds are available, but a permanent fix through updates is essential.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of secpath entries in the Linux kernel, leading to potential kernel panics.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can cause kernel panics, leading to system crashes and instability, particularly in environments with IP forwarding enabled.
Yes, updating the Linux package to version 6.12.13-1 or later will resolve the vulnerability.
As a temporary measure, you can disable IP forwarding to mitigate the risk until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
