5.5 Medium

CVE-2025-22005 In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in…

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything when it fails. Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init() but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak. Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the error path. Note that we can remove the fib6_nh_release() call in nh_create_ipv6() later in net-next.git.

Affected products and versions

Product	Affected versions	Fixed in
Linux 6.14	earliest → < 6.14	6.14
Linux 6.13	earliest → < 6.13.9	6.13.9
Linux 6.12	earliest → < 6.12.21	6.12.21
Linux 6.6	earliest → < 6.6.85	6.6.85
Linux 6.1	earliest → < 6.1.132	6.1.132
Linux 5.15	earliest → < 5.15.180	5.15.180
Linux 5.10	earliest → < 5.10.236	5.10.236
Linux 5.4	earliest → < 5.4.292	5.4.292
Linux	5.3	No fix stated

Show the 3 other branches

Product	Affected versions	Fixed in
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.7 → latest	No fix stated
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1	3.1.7 → latest	No fix stated
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.7 → latest	No fix stated