CVE-2025-21972

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The vulnerable code is a network-stack packet handler (`ETH_P_MCTP` packet_type → `mctp_route_input`), but MCTP has no internet-routable transport in the kernel — packets arrive from a device on the local management bus (SMBus/I2C, I3C, USB, serial), a limited administrative domain directly analogous to the Bluetooth/WiFi case.

AC:LAttack complexity, low

The attacker fully controls both preconditions: sending a multi-packet (SOM/EOM) fragmented message, and causing the skbs to be clones by packing several MCTP packets into a single transfer (`mctp-usb.c:219`). No race, memory-layout dependency, or victim state is involved, and the kunit reproducer added by the fix triggers it deterministically.

PR:NPrivileges required, none

There is no authentication or authorization anywhere on the path from `mctp_pkttype_receive()` to `mctp_frag_queue()` — MCTP packets are parsed and reassembled purely on header contents, so a device on the bus needs no credentials or local account.

UI:NUser interaction, none

Reassembly happens in softirq context on packet receive; no user action is needed on the victim system beyond having MCTP configured, which is the normal state for the affected BMC/host management deployments.

S:UScope, unchanged

The corruption and its consequences are confined to kernel skb structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

Writing the reassembly `frag_list` into a shared `skb_shared_info` cross-links skbs belonging to different reassembly contexts and to other subsystems (e.g. AF_PACKET clones), so a socket can be delivered a fragment chain from an unrelated message with mismatched length accounting — memory-state corruption leveragable for disclosure of data from another context.

I:HIntegrity impact, high

The bug both delivers incorrectly reassembled message content to MCTP sockets (corrupting PLDM/NVMe-MI/NC-SI management traffic) and plants an attacker-influenced skb pointer into a `skb_shared_info` owned by other subsystems, which is later dereferenced and freed by an owner that never expected a fragment list.

A:HAvailability impact, high

Every cloned fragmented message permanently leaks its skbs and backing data buffer through the circular `frag_list`/`dataref` reference, and the attacker can repeat this without limit — driving memory exhaustion and OOM/kernel failure on the memory-constrained BMC and embedded systems where MCTP is deployed.