CVE-2025-21972

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel's network stack has been identified, related to the reassembly of MCTP packets. The issue arises when the frag list used for reassembly is shared with other packets, leading to incorrect reassembly when packets are cloned and causing a memory leak due to circular references between fragments and their skb shared info. This problem can be triggered by the upcoming MCTP-over-USB driver, which uses skb clone, unlike other MCTP drivers that do not share SKBs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.