CVE-2025-21683

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix bpf_sk_select_reuseport() memory leak

As pointed out in the original comment, lookup in sockmap can return a TCP

ESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_EBPF

set before it was ESTABLISHED. In other words, a non-NULL sk_reuseport_cb

does not imply a non-refcounted socket.

Drop sk's reference in both error paths.

unreferenced object 0xffff888101911800 (size 2048):

comm "test_progs", pid 44109, jiffies 4297131437

hex dump (first 32 bytes):

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

80 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace (crc 9336483b):

__kmalloc_noprof+0x3bf/0x560

__reuseport_alloc+0x1d/0x40

reuseport_alloc+0xca/0x150

reuseport_attach_prog+0x87/0x140

sk_reuseport_attach_bpf+0xc8/0x100

sk_setsockopt+0x1181/0x1990

do_sock_setsockopt+0x12b/0x160

__sys_setsockopt+0x7b/0xc0

__x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References