PT-2025-8789 · Linux+6 · Linux Kernel+6

Syzbot · Published 2025-01-27 · Updated 2026-04-20 · CVE-2025-21706

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability has been resolved in the Linux kernel related to the mptcp module, specifically in the mptcp pm nl fullmesh function. The issue allows the fullmesh flag to be set on 'implicit' endpoints, which is not allowed. This was discovered by syzbot, triggering a warning. The vulnerability is related to the in-kernel path-manager and the set flags hook.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-11950

CVE-2025-21706

DLA-4102-1

OPENSUSE-SU-2025_1177-1

OPENSUSE-SU-2025_1178-1

OPENSUSE-SU-2025_1180-1

SUSE-SU-2025:01919-1

SUSE-SU-2025:01951-1

SUSE-SU-2025:01967-1

SUSE-SU-2025:1177-1

SUSE-SU-2025:1178-1

SUSE-SU-2025:1180-1

SUSE-SU-2025:20190-1

SUSE-SU-2025:20192-1

SUSE-SU-2025:20260-1

SUSE-SU-2025:20270-1

SUSE-SU-2025_01951-1

SUSE-SU-2025_01967-1

SUSE-SU-2025_1177-1

SUSE-SU-2025_1178-1

SUSE-SU-2025_1180-1

USN-7521-1

USN-7521-2

USN-7521-3

USN-7703-1

USN-7703-2

USN-7703-3

USN-7703-4

USN-7719-1

USN-7737-1

Affected Products

Astra Linux

Debian

Linuxmint

Linux Kernel

Red Os

Suse

Ubuntu

References · 1550

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21706.json · Exploit
• https://ubuntu.com/security/CVE-2024-57997 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-21871 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-21706 · Security Note
• https://ubuntu.com/security/CVE-2025-21864 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-21791 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-21820 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-58082 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-21742 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-58090 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7521-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-21836 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-21731 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01919-1 · Vendor Advisory