CVE-2025-21677 — pfcp: Destroy device along with udp socket's netns dismantle.

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

pfcp: Destroy device along with udp socket's netns dismantle.

pfcp_newlink() links the device to a list in dev_net(dev) instead of net, where a udp tunnel socket is created.

Even when net is removed, the device stays alive on dev_net(dev). Then, removing net triggers the splat below. [0]

In this example, pfcp0 is created in ns2, but the udp socket is created in ns1.

ip netns add ns1 ip netns add ns2 ip -n ns1 link add netns ns2 name pfcp0 type pfcp ip netns del ns1

Let's link the device to the socket's netns instead.

Now, pfcp_net_exit() needs another netdev iteration to remove all pfcp devices in the netns.

pfcp_dev_list is not used under RCU, so the list API is converted to the non-RCU variant.

pfcp_net_exit() can be converted to .exit_batch_rtnl() in net-next.

[0]: ref_tracker: net notrefcnt@00000000128b34dc has 1/1 users at sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236) inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1558) udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18) pfcp_create_sock (drivers/net/pfcp.c:168) pfcp_newlink (drivers/net/pfcp.c:182 drivers/net/pfcp.c:197) rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012) rtnetlink_rcv_msg (net/core/rtnetlink.c:6922) netlink_rcv_skb (net/netlink/af_netlink.c:2542) netlink_unicast (net/net…

Most recent entries from all

CVE-2025-21677 — pfcp: Destroy device along with udp socket's netns dismantle.