CVE-2025-22005 Linux CVE debrief

Who should care

Defenders of Linux kernel-based systems, especially those with exposure to untrusted networks or with critical infrastructure roles, should assess their exposure and apply mitigations.

Why it matters

Memory leak vulnerability in Linux kernel IPv6 implementation requires attention from defenders of affected systems, especially those with critical infrastructure roles or exposure to untrusted networks.

• Memory leak can lead to resource exhaustion
• Potential for denial-of-service (DoS) attacks
• Requires verification of affected versions and exposure
• Remediation priority for affected systems

Technical summary

The vulnerability exists in the Linux kernel's IPv6 implementation, specifically in the `fib_check_nh_v6_gw` function. A memory leak occurs when `fib6_nh_init` fails to allocate `fib6_nh->rt6i_pcpu`, resulting in a missing cleanup of `fib6_nh->nh_common.nhc_pcpu_rth_output`. The vulnerability has been resolved by adding a call to `fib_nh_common_release` and clearing `nhc_pcpu_rth_output` in the error path.

Defensive priority

Medium priority remediation is recommended for affected systems, especially those with exposure to untrusted networks or with critical infrastructure roles.

Recommended defensive actions

• Review and apply the recommended mitigations provided by the vendor
• Limit access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only
• Only build and run applications from trusted sources
• Perform vulnerability scanning to identify potentially affected systems
• Implement network segmentation to limit the attack surface
• Monitor system resources for signs of potential memory exhaustion
• Review system logs for suspicious activity related to IPv6 functionality

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected products. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor statements.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.