CVE-2025-21762
Published: 27 February 2025
Summary
CVE-2025-21762 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-21762 is a use-after-free (UAF) vulnerability in the Linux kernel's ARP implementation, specifically in the arp_xmit() function, which can be invoked without proper RTNL or RCU protection. This flaw, tied to CWE-416, affects the Linux kernel and was published on 2025-02-27 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation could grant high-impact confidentiality, integrity, and availability violations, such as arbitrary kernel memory corruption, potentially leading to privilege escalation, denial of service, or code execution within the kernel context.
Mitigation involves applying the relevant stable kernel patches referenced in the advisory, including commits such as 01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe, 10f555e3f573d004ae9d89b3276abb58c4ede5c3, 2c331718d3389b6c5f6855078ab7171849e016bd, 307cd1e2d3cb1cbc6c40c679cada6d7168b18431, and a42b69f692165ec39db42d595f4f65a4c8f42e44 from git.kernel.org, which introduce RCU protection to arp_xmit() to prevent the UAF.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5171
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF vulnerability enabling arbitrary memory corruption and privilege escalation from low-privileged user context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the kernel UAF flaw in arp_xmit() by applying patches that introduce RCU protection, directly preventing exploitation.
Implements memory protection controls that mitigate unauthorized access or execution from the UAF vulnerability in the kernel's ARP implementation.
Conducts vulnerability scanning to identify systems running vulnerable Linux kernel versions affected by CVE-2025-21762.