Memory leak in Linux kernel ipv6

1) Memory leak

EUVDB-ID: #VU106954

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22005

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the in6_dev_put() function in net/ipv6/route.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/119dcafe36795a15ae53351cbbd6177aaf94ffef
https://git.kernel.org/stable/c/29d91820184d5cbc70f3246d4911d96eaeb930d6
https://git.kernel.org/stable/c/77c41cdbe6bce476e08d3251c0d501feaf10a9f3
https://git.kernel.org/stable/c/9740890ee20e01f99ff1dde84c63dcf089fabb98
https://git.kernel.org/stable/c/d3d5b4b5ae263c3225db363ba08b937e2e2b0380

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.