CVE-2025-21678

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

gtp: Destroy device along with udp socket's netns dismantle.

gtp_newlink() links the device to a list in dev_net(dev) instead of

src_net, where a udp tunnel socket is created.

Even when src_net is removed, the device stays alive on dev_net(dev).

Then, removing src_net triggers the splat below. [0]

In this example, gtp0 is created in ns2, and the udp socket is created

in ns1.

ip netns add ns1

ip netns add ns2

ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn

ip netns del ns1

Let's link the device to the socket's netns instead.

Now, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove

all gtp devices in the netns.

[0]:

ref_tracker: net notrefcnt@000000003d6e7d05 has 1/2 users at

sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236)

inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252)

__sock_create (net/socket.c:1558)

udp_sock_create4 (net/ipv4/u

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References