CVE-2025-21763
Published: 27 February 2025
Summary
CVE-2025-21763 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-21763 is a use-after-free (UAF) vulnerability, classified under CWE-416, in the Linux kernel's neighbour subsystem. The issue arises because the __neigh_notify() function can be called without proper RTNL or RCU protection, potentially leading to a UAF condition. It affects Linux kernel versions prior to the application of the relevant stable patches and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution, data corruption, or system crashes within the kernel context.
The vulnerability has been addressed through kernel patches available in the Linux stable repository. Key commits include 1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379, 40d8f2f2a373b6c294ffac394d2bb814b572ead1, 559307d25235e24b5424778c7332451b6c741159, 784eb2376270e086f7db136d154b8404edacf97b, and 8666e9aab801328c1408a19fbf4070609dc0695a, which implement RCU protection in __neigh_notify() to prevent the UAF. Security practitioners should update to kernels incorporating these fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5167
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local use-after-free vulnerability in the Linux kernel allowing low-privileged attackers to achieve arbitrary kernel code execution, directly enabling privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the UAF vulnerability by identifying, reporting, and applying the Linux kernel patches that implement RCU protection in __neigh_notify().
Detects systems affected by CVE-2025-21763 through vulnerability scanning to identify vulnerable Linux kernel versions in the neighbour subsystem.
Implements memory protection mechanisms that mitigate exploitation of the kernel UAF by randomizing memory layouts or enforcing non-executable regions.