Kernel Memory Leak Vulnerability in Linux Package: CVE-2025-21768
Summary
DEBIAN-CVE-2025-21768: In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels Some lwtunnels have a dst cache for post-transformation dst. Affects linux versions < 6.12.16-1. Fixed in 6.12.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various environments, from servers to embedded systems. This vulnerability affects the networking stack, specifically the IPv6 implementation, which is crucial for modern internet connectivity and communication.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified that affects the handling of destination references in lightweight tunnels (lwtunnels) for IPv6. Specifically, when the destination of a packet does not change, a reference to the lwtunnel may be incorrectly recorded in its own cache. This can lead to a memory leak, as the lwtunnel state will not be freed, potentially resulting in increased memory usage and degraded system performance. The issue was discovered during testing with the ioam6.sh script, and while it is uncertain if other protocols like RPL and SEG6 are affected, the design flaw suggests they could be vulnerable as well.
How To Fix
Minimum fixed version
6.12.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The CVE-2025-21768 vulnerability in the Linux kernel poses a significant risk due to potential memory leaks in IPv6 lightweight tunnels. Users are advised to update their systems to the patched version to ensure security and stability. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21768 is a vulnerability in the Linux kernel that can lead to memory leaks in certain IPv6 lightweight tunnels.
This vulnerability can cause increased memory usage, potentially leading to performance degradation or system instability.
If you are using versions of the Linux kernel prior to 6.12.16-1, your system may be vulnerable to this issue.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
