CVE-2025-21761: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21761 Overview

CVE-2025-21761 is a use-after-free (UAF) vulnerability [CWE-416] in the Linux kernel's Open vSwitch (openvswitch) subsystem. The flaw resides in the ovs_vport_cmd_fill_info() function, which could be invoked without holding the Read-Copy-Update (RCU) lock or the Routing Netlink (RTNL) lock. Without proper synchronization, kernel code paths could access freed network device (net_device) memory. Maintainers resolved the issue by adding RCU protection and switching to dev_net_rcu() for safe dereferencing. The vulnerability affects the Linux kernel through releases including 6.14-rc1 and 6.14-rc2.

Critical Impact
A local, authenticated attacker can trigger memory corruption in the kernel through Open vSwitch netlink operations, leading to code execution, privilege escalation, or system compromise.

Affected Products

Linux Kernel (multiple stable branches prior to backported fixes)
Linux Kernel 6.14-rc1
Linux Kernel 6.14-rc2

Discovery Timeline

2025-02-27 - CVE-2025-21761 published to the National Vulnerability Database (NVD)
2025-03 - Debian LTS security advisory issued referencing the fix
2025-05 - Additional Debian LTS advisory published
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21761

Vulnerability Analysis

The vulnerability affects the Open vSwitch (OVS) netlink command handler ovs_vport_cmd_fill_info(). This function serializes vport information for netlink replies to userspace management tools. Historically, the function assumed callers would hold either the RTNL mutex or an RCU read-side critical section before accessing the underlying net_device structure. In practice, however, certain code paths reached ovs_vport_cmd_fill_info() without either lock held.

When the function dereferenced the associated network device or accessed its network namespace via dev_net(), the device could be concurrently removed and freed by another CPU. This creates a classic use-after-free condition on kernel heap memory. Exploiting UAF flaws in kernel networking subsystems typically leads to arbitrary write primitives and local privilege escalation.

Root Cause

The root cause is missing synchronization when accessing RCU-protected network device state. The dev_net() accessor requires the caller to guarantee the device's lifetime, but ovs_vport_cmd_fill_info() did not enforce that invariant on every code path. The upstream fix replaces the unsafe accessor with dev_net_rcu() and wraps the dereference in an explicit RCU read-side critical section.

Attack Vector

Exploitation requires local access with permission to issue Open vSwitch netlink commands (typically CAP_NET_ADMIN within a user namespace or on the host). An attacker races vport enumeration against vport deletion to cause the kernel to access freed memory. Successful exploitation yields code execution in kernel context, with full impact to confidentiality, integrity, and availability. See the Linux kernel patch commit for the corrected locking model.

Detection Methods for CVE-2025-21761

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing ovs_vport_cmd_fill_info, dev_net, or openvswitch in dmesg or journalctl -k output.
Unexpected process crashes or privilege transitions from users interacting with ovs-vsctl, ovs-dpctl, or raw NETLINK_GENERIC sockets.
Loading of the openvswitch kernel module by non-administrative workloads that do not require OVS.

Detection Strategies

Monitor for kernel warnings and KASAN or KMSAN reports mentioning use-after-free in the openvswitch module.
Audit netlink socket usage with auditd rules on the socket and sendmsg syscalls to identify processes issuing OVS Generic Netlink commands.
Correlate kernel version telemetry against the fixed stable commits to identify unpatched hosts at scale.

Monitoring Recommendations

Ingest kernel logs into a centralized SIEM and alert on stack traces containing openvswitch symbols.
Track container and VM workloads that hold CAP_NET_ADMIN, as these are prerequisites for triggering the flaw.
Baseline expected OVS management activity per host so anomalous vport create or delete bursts stand out.

How to Mitigate CVE-2025-21761

Immediate Actions Required

Inventory Linux hosts running the openvswitch kernel module and identify those on unpatched kernels.
Apply the vendor-supplied kernel update from your distribution and reboot affected systems.
Restrict CAP_NET_ADMIN and user namespace creation for untrusted local users and containers until patched.

Patch Information

The fix is available upstream across multiple stable branches. Relevant commits include a884f576, a8816b3f, a849a10d, 90b2f49a, 8ec57509, 7e01abc3, e85a25d1, and 58289377. Debian users should apply the updates announced in the Debian LTS Announcement March 2025 and the Debian LTS Announcement May 2025. Industrial operators should review the Siemens Security Advisory SSA-265688 for affected product guidance.

Workarounds

Unload the openvswitch module (modprobe -r openvswitch) on systems that do not require it, and blacklist it from auto-loading.
Remove CAP_NET_ADMIN from workloads that do not need to manage networking, and disable unprivileged user namespaces where feasible.
Constrain access to OVS control sockets and management tooling to a small set of trusted administrators.

bash

# Prevent the vulnerable module from loading on hosts that do not need Open vSwitch
echo "blacklist openvswitch" | sudo tee /etc/modprobe.d/blacklist-openvswitch.conf
sudo modprobe -r openvswitch 2>/dev/null || true

# Disable unprivileged user namespaces to reduce local attack surface
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo "kernel.unprivileged_userns_clone=0" | sudo tee /etc/sysctl.d/99-harden-userns.conf