CVE-2025-21764
Published: 27 February 2025
Summary
CVE-2025-21764 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-21764 is a use-after-free (UAF) vulnerability, classified under CWE-416, in the Linux kernel's ndisc_alloc_skb() function within the Neighbor Discovery for IPv6 (ndisc) component. The issue arises because ndisc_alloc_skb() can be invoked without the required RTNL or RCU protection, potentially leading to a UAF condition. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, such as arbitrary code execution, privilege escalation, or kernel crashes leading to denial of service.
Mitigation involves applying the upstream patches provided in the referenced stable kernel commits, including 3c2d705f5adf5d860aaef90cb4211c0fde2ba66d, 628e6d18930bbd21f2d4562228afe27694f66da9, 96fc896d0e5b37c12808df797397fb16f3080879, 9e0ec817eb41a55327a46cd3ce331a9868d60304, and b870256dd2a5648d5ed2f22316b3ac29a7e5ed63, which add RCU protection to ndisc_alloc_skb() to prevent the UAF. Security practitioners should update affected Linux kernel versions to incorporate these fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5159
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() can be called without RTNL or RCU being held. Add RCU protection to avoid possible UAF.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF vulnerability in ndisc_alloc_skb() directly enables exploitation for privilege escalation and arbitrary code execution by low-privileged attackers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of flaws such as the UAF in ndisc_alloc_skb() by applying the upstream kernel patches that add RCU protection.
Implements memory protection mechanisms like address space layout randomization and supervisor mode execution prevention that mitigate exploitation of kernel use-after-free vulnerabilities.
Supports vulnerability scanning to identify the presence of CVE-2025-21764 in Linux kernels lacking the RCU protection fixes.