Skip to main content

Linux Kernel CVE-2025-21760

HIGH
Use After Free (CWE-416)
2025-02-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Use After Free Memory Corruption
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

NDISC is link-local so AV:A not AV:N; a timing race gives AC:H; no auth needed (PR:N); most likely impact is a crash (A:H) with limited leak (C:L) and no integrity effect.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 06:31 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:22 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:22 NVD
7.8 (HIGH) 8.1 (HIGH)
Analysis Generated
Mar 28, 2026 - 18:28 vuln.today
Patch released
Mar 28, 2026 - 18:28 nvd
Patch available
CVE Published
Feb 27, 2025 - 03:15 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ndisc: extend RCU protection in ndisc_send_skb()

ndisc_send_skb() can be called without RTNL or RCU held.

Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF.

AnalysisAI

Use-after-free in the Linux kernel's IPv6 neighbor discovery (ndisc) subsystem allows an adjacent attacker to trigger a race in ndisc_send_skb(), which could execute without RTNL or RCU held and dereference a freed net-namespace/device reference. Affected pre-release kernels include 6.14-rc1 and 6.14-rc2, with the flaw in the ndisc TX path fixed by extending RCU protection. No public exploit has been identified, EPSS is very low (0.05%, 15th percentile), and it is not listed in CISA KEV, indicating theoretical rather than active risk despite the high 8.1 CVSS.

Technical ContextAI

The bug lives in the kernel's IPv6 Neighbor Discovery protocol (RFC 4861) implementation in net/ipv6/ndisc.c. ndisc_send_skb() transmits ND messages (router/neighbor solicitations and advertisements) and resolves the owning network namespace from the net_device via dev_net(). Because the function may run without the RTNL mutex or an RCU read-side critical section held, the referenced object can be freed concurrently, producing the CWE-416 use-after-free. The fix acquires rcu_read_lock() earlier and switches to the RCU-safe dev_net_rcu() accessor so the namespace pointer stays valid for the duration of its use. This is a concurrency/object-lifetime defect in a core networking hot path, not a parsing or input-validation flaw.

RemediationAI

Patch available per vendor advisory: update to a kernel build that includes the ndisc RCU fix, applied upstream via the stable commits at git.kernel.org (e.g. 04e05112f10354ffc3bb6cc796d553bab161594c and the seven sibling backports). Distribution users should install fixed packages from their vendor: SUSE via SUSE-SU-2025:01919/01951/01967/1177/1178, and Debian LTS per the debian-lts-announce advisories (2025/03 msg00028, 2025/05 msg00030). A reboot is required for the new kernel to take effect, or use live-patching if your distro provides it for this fix. No clean feature-level workaround exists because ND is mandatory for IPv6 operation; as a compensating control you can reduce exposure by disabling IPv6 on hosts that do not require it (sysctl net.ipv6.conf.all.disable_ipv6=1), accepting loss of IPv6 connectivity, and by restricting untrusted devices on local L2 segments to shrink the adjacent attack surface until patched.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.5.1 Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-6.11 Container suse/sl-micro/6.1/base-os-container:2.2.0-4.21 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.12 Container suse/sl-micro/6.1/kvm-os-container:2.2.0-4.20 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.15 Container suse/sl-micro/6.1/rt-os-container:2.2.0-4.21 Affected
Container suse/sle-micro-rancher/5.2:latest Affected

Share

CVE-2025-21760 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy