CVE-2025-21715
Published: 27 February 2025
Summary
CVE-2025-21715 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 8.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-21715 is a use-after-free (UAF) vulnerability in the Linux kernel's davicom network driver, specifically within the dm9000_drv_remove function. The issue arises because the netdev private data structure 'dm' is accessed after the free_netdev() call, leading to potential UAF conditions. This flaw, classified under CWE-416, affects systems using the dm9000 driver and was assigned a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution or system crashes on affected kernel instances.
Mitigation involves applying the upstream patches from the Linux kernel stable repository, as detailed in the referenced commits (e.g., https://git.kernel.org/stable/c/19e65c45a1507a1a2926649d2db3583ed9d55fd9 and others). The fix repositions the free_netdev() call to the end of dm9000_drv_remove to prevent post-free usage of 'dm', similar to a prior resolution in the qcom/emac driver. The bug was identified via static analysis tools.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5225
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it cannot be used after free_netdev() call. Using dm after free_netdev() can cause UAF bug. Fix it by…
more
moving free_netdev() at the end of the function. This is similar to the issue fixed in commit ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove"). This bug is detected by our static analysis tool.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The local use-after-free vulnerability in the Linux kernel dm9000 driver enables arbitrary code execution or crashes from low-privileged accounts, directly mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the UAF vulnerability in the dm9000_drv_remove function by requiring timely application of the kernel patch that repositions free_netdev() to prevent post-free access to 'dm'.
Implements memory protections such as non-executable memory regions and stack guards that mitigate exploitation of the UAF in the davicom network driver even if unpatched.
Enables detection of the CVE-2025-21715 vulnerability through vulnerability scanning of kernel versions and configurations using the dm9000 driver.