CVE-2025-21677

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pfcp: Destroy device along with udp socket's netns dismantle.

pfcp_newlink() links the device to a list in dev_net(dev) instead

of net, where a udp tunnel socket is created.

Even when net is removed, the device stays alive on dev_net(dev).

Then, removing net triggers the splat below. [0]

In this example, pfcp0 is created in ns2, but the udp socket is

created in ns1.

ip netns add ns1

ip netns add ns2

ip -n ns1 link add netns ns2 name pfcp0 type pfcp

ip netns del ns1

Let's link the device to the socket's netns instead.

Now, pfcp_net_exit() needs another netdev iteration to remove

all pfcp devices in the netns.

pfcp_dev_list is not used under RCU, so the list API is converted

to the non-RCU variant.

pfcp_net_exit() can be converted to .exit_batch_rtnl() in net-next.

[0]:

ref_tracker: net notrefcnt@00000000128b34dc has 1/1 users at

sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References