CVE-2025-21719 is a vulnerability identified in the Linux kernel's IP multicast routing (ipmr) subsystem. Specifically, the issue arises from the function mr_mfc_uses_dev() being called for unresolved multicast forwarding cache (mfc) entries. These unresolved entries (unres entries) are represented by a structure aliasing to 'struct sk_buff_head unresolved', which contains two pointers. The improper handling and invocation of mr_mfc_uses_dev() on these unresolved entries leads to a kernel crash due to an invalid memory access, as evidenced by the kernel paging request failure and KASAN (Kernel Address Sanitizer) warnings. The crash occurs because the code attempts to dereference pointers that are not valid in this context, resulting in a wild memory access. The vulnerability was discovered by syzbot, an automated kernel fuzzer, and affects the Linux kernel version 6.13.0-rc7 and potentially other versions containing the flawed code. The root cause is a logic error where the code path calls mr_mfc_uses_dev() on unresolved multicast forwarding cache entries, which was never a valid operation. The fix involves removing this erroneous call to prevent the kernel from crashing. This vulnerability impacts the stability and reliability of systems running affected Linux kernel versions, particularly those utilizing IP multicast routing features. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions with IP multicast routing enabled. Multicast routing is often used in enterprise networks for efficient distribution of data streams such as video conferencing, IPTV, and real-time data feeds. A kernel crash triggered by this vulnerability can lead to denial of service (DoS), causing system downtime and potential disruption of critical services. Organizations relying on multicast for internal communications or service delivery may experience interruptions, impacting operational continuity. Additionally, kernel crashes can lead to data loss or corruption if occurring during critical operations. While the vulnerability does not appear to allow privilege escalation or remote code execution, the resulting instability could be exploited by attackers to cause persistent denial of service. European entities with infrastructure running Linux kernels in data centers, cloud environments, or embedded systems that utilize multicast routing are at risk. The absence of known exploits reduces immediate threat but does not eliminate the risk of future exploitation once the vulnerability becomes widely known.

1. Immediate patching: Apply the official Linux kernel patches that remove the erroneous call to mr_mfc_uses_dev() for unresolved entries as soon as they are available. Monitor Linux kernel mailing lists and vendor advisories for updates. 2. Kernel version management: Avoid deploying or continue using Linux kernel versions known to contain this vulnerability (e.g., 6.13.0-rc7) in production environments until patched versions are released. 3. Disable multicast routing if not required: For systems that do not require IP multicast routing, disable the ipmr subsystem to reduce the attack surface. 4. Implement kernel crash monitoring: Deploy monitoring tools that can detect kernel panics or crashes promptly to enable rapid incident response and system recovery. 5. Network segmentation: Limit exposure of multicast routing services to trusted network segments to reduce the likelihood of triggering the vulnerability from untrusted sources. 6. Conduct thorough testing: Before deploying kernel updates, perform regression testing in controlled environments to ensure stability and compatibility with existing multicast routing configurations. 7. Maintain backups and recovery plans: Ensure that critical data and system states are regularly backed up to mitigate the impact of potential crashes and facilitate quick restoration.