Linux Kernel up to 6.1.130/6.6.82/6.12.18/6.13.6 IPC Response ipc_msg_send_request type confusion

Summaryinfo

A vulnerability labeled as critical has been found in Linux Kernel up to 6.1.130/6.6.82/6.12.18/6.13.6. Affected by this vulnerability is the function ipc_msg_send_request of the component IPC Response Handler. The manipulation results in type confusion. This vulnerability is identified as CVE-2025-21947. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.1.130/6.6.82/6.12.18/6.13.6. It has been classified as critical. Affected is the function ipc_msg_send_request of the component IPC Response Handler. The manipulation with an unknown input leads to a type confusion vulnerability. CWE is classifying the issue as CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion between messages, resulting in access to unexpected parts of memory after an incorrect delivery. ksmbd check type of ipc response but missing add continue to check next ipc reponse.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2025-21947 since 12/29/2024. The exploitability is told to be difficult. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/01/2026).

The vulnerability scanner Nessus provides a plugin with the ID 234309 (Debian dsa-5900 : affs-modules-6.1.0-28-4kc-malta-di - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.1.131, 6.6.83, 6.12.19 or 6.13.7 eliminates this vulnerability. Applying the patch 6321bbda4244b93802d61cfe0887883aae322f4b/76861630b29e51373e73e7b00ad0d467b6941162/3cb2b2e41541fe6f9cc55ca22d4c0bd260498aea/1e8833c03a38e1d5d5df6484e3f670a2fd38fb76/e2ff19f0b7a30e03516e6eb73b948e27a55bc9d2 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (234309) and CERT Bund (WID-SEC-2025-0683). Once again VulDB remains the best source for vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• Dell Avamar
• Open Source Linux Kernel
• SolarWinds Security Event Manager
• Dell NetWorker
• Dell Secure Connect Gateway
• IBM Security Verify Access

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.1.130
• 6.6.0
• 6.6.1
• 6.6.2
• 6.6.3
• 6.6.4
• 6.6.5
• 6.6.6
• 6.6.7
• 6.6.8
• 6.6.9
• 6.6.10
• 6.6.11
• 6.6.12
• 6.6.13
• 6.6.14
• 6.6.15
• 6.6.16
• 6.6.17
• 6.6.18
• 6.6.19
• 6.6.20
• 6.6.21
• 6.6.22
• 6.6.23
• 6.6.24
• 6.6.25
• 6.6.26
• 6.6.27
• 6.6.28
• 6.6.29
• 6.6.30
• 6.6.31
• 6.6.32
• 6.6.33
• 6.6.34
• 6.6.35
• 6.6.36
• 6.6.37
• 6.6.38
• 6.6.39
• 6.6.40
• 6.6.41
• 6.6.42
• 6.6.43
• 6.6.44
• 6.6.45
• 6.6.46
• 6.6.47
• 6.6.48
• 6.6.49
• 6.6.50
• 6.6.51
• 6.6.52
• 6.6.53
• 6.6.54
• 6.6.55
• 6.6.56
• 6.6.57
• 6.6.58
• 6.6.59
• 6.6.60
• 6.6.61
• 6.6.62
• 6.6.63
• 6.6.64
• 6.6.65
• 6.6.66
• 6.6.67
• 6.6.68
• 6.6.69
• 6.6.70
• 6.6.71
• 6.6.72
• 6.6.73
• 6.6.74
• 6.6.75
• 6.6.76
• 6.6.77
• 6.6.78
• 6.6.79
• 6.6.80
• 6.6.81
• 6.6.82
• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4
• 6.12.5
• 6.12.6
• 6.12.7
• 6.12.8
• 6.12.9
• 6.12.10
• 6.12.11
• 6.12.12
• 6.12.13
• 6.12.14
• 6.12.15
• 6.12.16
• 6.12.17
• 6.12.18
• 6.13.0
• 6.13.1
• 6.13.2
• 6.13.3
• 6.13.4
• 6.13.5
• 6.13.6

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion