CVE-2025-21760: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21760 Overview

CVE-2025-21760 is a use-after-free vulnerability [CWE-416] in the Linux kernel's IPv6 Neighbor Discovery (ndisc) subsystem. The flaw resides in the ndisc_send_skb() function, which can be invoked without the RTNL mutex or RCU (Read-Copy-Update) read lock held. This missing synchronization creates a window where a network device's namespace pointer can be freed while still in use, leading to a potential use-after-free condition.

The vulnerability affects Linux kernel versions up to and including 6.14-rc2. A local attacker with low privileges can leverage this condition to compromise kernel memory integrity.

Critical Impact
Successful exploitation may allow a local attacker to trigger kernel memory corruption, potentially leading to privilege escalation, information disclosure, or system-wide denial of service.

Affected Products

Linux Kernel versions prior to the fix commits (multiple stable branches)
Linux Kernel 6.14-rc1
Linux Kernel 6.14-rc2

Discovery Timeline

2025-02-27 - CVE-2025-21760 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2025-21760

Vulnerability Analysis

The vulnerability exists in the IPv6 Neighbor Discovery Protocol (NDP) implementation within the Linux kernel networking stack. The function ndisc_send_skb() is responsible for transmitting Neighbor Discovery packets, including router solicitations, neighbor solicitations, and neighbor advertisements.

The function accesses the network namespace associated with a network device without holding the appropriate synchronization primitives. Specifically, ndisc_send_skb() can be called on paths where neither the RTNL (Routing Netlink) mutex nor an RCU read-side critical section is active. This violates the kernel's memory reclamation guarantees for the underlying data structures.

Root Cause

The root cause is insufficient RCU protection around access to network device and namespace pointers within ndisc_send_skb(). Without an active RCU read-side critical section, the kernel's grace period mechanism can reclaim memory referenced by the function. The fix acquires rcu_read_lock() earlier in the code path and switches the accessor to dev_net_rcu(), ensuring the namespace reference remains valid throughout its use.

Attack Vector

Exploitation requires local access with low privileges on a system with IPv6 networking enabled. An attacker can trigger paths that invoke ndisc_send_skb() outside of protected contexts, potentially through crafted network operations or race conditions involving network device teardown. Successful triggering of the use-after-free may permit corruption of kernel memory structures.

The vulnerability is not remotely exploitable and requires no user interaction beyond the attacker's local session. No public proof-of-concept exploit has been released, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-21760

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ndisc_send_skb, dev_net, or IPv6 neighbor discovery code paths in dmesg or /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free access in the net/ipv6/ndisc.c module on debug kernels.
Anomalous kernel crashes correlated with IPv6 traffic bursts or rapid network interface configuration changes.

Detection Strategies

Enumerate running kernel versions across the fleet and compare against the fixed commit hashes published on git.kernel.org to identify vulnerable hosts.
Enable KASAN on test kernels to surface use-after-free conditions during pre-production validation.
Correlate kernel crash telemetry with local user session activity to identify potential exploitation attempts.

Monitoring Recommendations

Forward dmesg and kernel audit logs to a centralized logging platform for retention and correlation.
Monitor for unauthorized loading of kernel modules or unusual sysctl changes to IPv6 parameters.
Track local privilege escalation indicators such as unexpected UID transitions or new SUID binaries following kernel instability events.

How to Mitigate CVE-2025-21760

Immediate Actions Required

Apply the upstream Linux kernel patches from the stable trees as soon as vendor-supplied packages become available for your distribution.
Prioritize patching multi-tenant systems, container hosts, and shared workstations where untrusted local users are present.
Review Debian LTS advisories (March 2025 and May 2025) and Siemens advisories (SSA-019113, SSA-265688) for platform-specific guidance.

Patch Information

The fix is available across multiple stable kernel branches. Reference the upstream commits including 04e05112f103, 10a1f3fece2f, 4d576202b90b, 789230e5a8c1, a9319d800b57, ae38982f5216, e24d225e4cb8, and ed6ae1f325d3. Update to the latest stable release provided by your Linux distribution vendor.

Workarounds

Restrict local user access on systems that cannot be immediately patched, minimizing exposure to untrusted local accounts.
Where operationally feasible, disable IPv6 on isolated systems that do not require it by setting net.ipv6.conf.all.disable_ipv6=1 and net.ipv6.conf.default.disable_ipv6=1 via sysctl.
Apply mandatory access controls such as SELinux or AppArmor policies to reduce the blast radius of successful local privilege escalation.

bash

# Configuration example: temporarily disable IPv6 as a workaround
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1

# Persist across reboots
echo 'net.ipv6.conf.all.disable_ipv6=1' | sudo tee -a /etc/sysctl.d/99-cve-2025-21760.conf
echo 'net.ipv6.conf.default.disable_ipv6=1' | sudo tee -a /etc/sysctl.d/99-cve-2025-21760.conf
sudo sysctl -p /etc/sysctl.d/99-cve-2025-21760.conf

# Verify current kernel version against fixed builds
uname -r