Skip to main content

Linux Kernel CVE-2025-21762

HIGH
Use After Free (CWE-416)
2025-02-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Use After Free Memory Corruption
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

ARP is link-local so AV:A not AV:N; winning the race is hard (AC:H); no auth needed (PR:N); a UAF race most plausibly crashes the kernel (A:H) with limited integrity impact and no reliable disclosure.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 06:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:22 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:22 NVD
7.8 (HIGH) 8.1 (HIGH)
Analysis Generated
Mar 28, 2026 - 18:28 vuln.today
Patch released
Mar 28, 2026 - 18:28 nvd
Patch available
CVE Published
Feb 27, 2025 - 03:15 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

arp: use RCU protection in arp_xmit()

arp_xmit() can be called without RTNL or RCU protection.

Use RCU protection to avoid potential UAF.

AnalysisAI

Use-after-free in the Linux kernel's ARP transmit path (arp_xmit()) allows attackers to trigger memory corruption because the function could execute without RTNL or RCU protection, permitting concurrent access to freed network structures. The affected code spans the kernel networking stack up to the 6.14-rc series, with the fix backported across multiple stable branches. EPSS is very low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis; the issue is a hardening/race-condition fix rather than a demonstrated remote weapon.

Technical ContextAI

The vulnerability lives in the kernel's ARP (Address Resolution Protocol) layer, specifically arp_xmit(), which transmits ARP frames at layer 2. The kernel uses RCU (Read-Copy-Update) and the RTNL mutex to safely coordinate access to networking data structures that can be modified or freed concurrently. Because arp_xmit() could be reached on code paths holding neither lock, a concurrent teardown could free an object still referenced by the transmit path - the classic CWE-416 Use-After-Free pattern. The fix wraps the access in an rcu_read_lock()/rcu_read_unlock() critical section so the object cannot be reclaimed mid-use. CPE data confirms the sole affected product is cpe:2.3:o:linux:linux_kernel, with 6.14:rc1 and 6.14:rc2 explicitly enumerated alongside earlier stable ranges.

RemediationAI

Patch available per vendor advisory - upstream fixes are merged and backported across stable branches (see git.kernel.org/stable commits 01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe, 10f555e3f573d004ae9d89b3276abb58c4ede5c3, and siblings). The primary action is to upgrade to your distribution's patched kernel and reboot: SUSE users should apply SUSE-SU-2025:1177/1178/01919/01951/01967, and Debian LTS users should follow debian-lts-announce 2025/03/msg00028 and 2025/05/msg00030; exact package versions are listed in those advisories. No standalone kernel configuration workaround exists for a race-condition fix in the ARP path, so patching is the only reliable remedy; as an interim compensating control on hosts that cannot reboot immediately, limit exposure to the local broadcast/ARP domain by segmenting layer-2 networks and restricting untrusted devices on the same VLAN, accepting the trade-off that this does not eliminate the race for any already-adjacent attacker.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.5.1 Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-6.11 Container suse/sl-micro/6.1/base-os-container:2.2.0-4.21 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.12 Container suse/sl-micro/6.1/kvm-os-container:2.2.0-4.20 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.15 Container suse/sl-micro/6.1/rt-os-container:2.2.0-4.21 Affected
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected

Share

CVE-2025-21762 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy