CVE-2025-21764: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21764 Overview

CVE-2025-21764 is a use-after-free vulnerability [CWE-416] in the Linux kernel's IPv6 Neighbor Discovery (ndisc) subsystem. The flaw exists in the ndisc_alloc_skb() function, which could be called without RTNL (Routing Netlink) or RCU (Read-Copy-Update) protection. Without these synchronization primitives, the function could access network device structures after they had been freed by another concurrent thread. A local attacker with the ability to trigger IPv6 neighbor discovery operations can exploit this race to corrupt kernel memory.

Critical Impact
Local attackers can trigger memory corruption in the Linux kernel networking stack, potentially leading to privilege escalation, kernel information disclosure, or denial of service on affected systems.

Affected Products

Linux Kernel (multiple stable branches prior to the corresponding fix commits)
Linux Kernel 6.14-rc1
Linux Kernel 6.14-rc2

Discovery Timeline

2025-02-27 - CVE-2025-21764 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-21764

Vulnerability Analysis

The vulnerability resides in the IPv6 Neighbor Discovery Protocol (ndisc) code path, specifically in ndisc_alloc_skb(). This function allocates a socket buffer (sk_buff) for transmitting neighbor discovery messages such as Neighbor Solicitations, Neighbor Advertisements, and Router Advertisements. The function dereferences network device state that requires synchronization against concurrent modification.

The upstream fix introduces RCU read-side critical sections around the affected accesses. The patches are tracked across multiple stable branches via commits including 3c2d705f5adf, 628e6d18930b, 96fc896d0e5b, 9e0ec817eb41, b870256dd2a5, bbec88e4108e, c30893ef3d9c, and cd1065f92eb7.

Root Cause

The root cause is missing RCU protection in ndisc_alloc_skb(). Callers invoke this function from contexts that hold neither the RTNL mutex nor an RCU read-side lock. Network device pointers and associated data structures rely on RCU for safe lockless access. When ndisc_alloc_skb() reads these structures without synchronization, a concurrent unregistration or teardown can free the underlying memory before the read completes. The result is a use-after-free condition [CWE-416] on kernel heap objects.

Attack Vector

Exploitation requires local access with the ability to trigger IPv6 neighbor discovery traffic and to influence network device lifecycle events. An attacker races neighbor discovery operations against rapid creation and destruction of network interfaces, such as virtual interfaces created via unprivileged user namespaces where permitted. Successful exploitation corrupts kernel memory, which a skilled attacker can shape into write primitives for privilege escalation. The vulnerability is not remotely exploitable, as the CVSS vector specifies a local attack vector.

No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-21764

Indicators of Compromise

Unexpected kernel oops, BUG, or KASAN reports referencing ndisc_alloc_skb, ndisc_send_skb, or ipv6/ndisc.c in dmesg and /var/log/kern.log.
Kernel panics or soft lockups correlated with high IPv6 neighbor discovery traffic or rapid network namespace churn.
Unprivileged processes creating and destroying network namespaces or virtual interfaces at high frequency.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test systems to surface use-after-free conditions in the ndisc code path during validation.
Audit installed kernel package versions against the fixed versions referenced in each distribution's advisory, including the Debian LTS Announcement March 2025 and Debian LTS Announcement May 2025.
Monitor for the patch commit hashes such as 3c2d705f5adf and bbec88e4108e in custom kernel builds to confirm remediation.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on general protection fault, KASAN: use-after-free, or slab-use-after-free messages.
Track unshare, clone with CLONE_NEWNET, and ip link operations from unprivileged users to detect race-condition reconnaissance.
Baseline IPv6 neighbor discovery traffic volume per host and alert on anomalous bursts that could indicate exploitation attempts.

How to Mitigate CVE-2025-21764

Immediate Actions Required

Apply vendor-supplied kernel updates from your Linux distribution as soon as they are available, prioritizing systems exposed to untrusted local users.
Reboot affected hosts after patch installation to load the fixed kernel image.
Review and restrict the use of unprivileged user namespaces on multi-tenant or shared systems where feasible.

Patch Information

The fix adds RCU protection inside ndisc_alloc_skb() and was backported across multiple stable kernel branches. Reference the upstream commits listed in the kernel.org stable tree and distribution advisories including the Siemens Security Advisory SSA-265688 for industrial deployments. Debian users should follow the Debian LTS Announcement May 2025 for affected package versions.

Workarounds

Disable IPv6 on systems that do not require it by setting net.ipv6.conf.all.disable_ipv6=1 and net.ipv6.conf.default.disable_ipv6=1 in /etc/sysctl.conf.
Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 to reduce the attacker's ability to manipulate network interfaces.
Apply mandatory access control policies (SELinux, AppArmor) to limit which processes can perform network configuration operations.

bash

# Configuration example
# Verify running kernel version against distribution advisory
uname -r

# Optionally disable IPv6 as a temporary mitigation
echo 'net.ipv6.conf.all.disable_ipv6=1' | sudo tee -a /etc/sysctl.d/99-cve-2025-21764.conf
echo 'net.ipv6.conf.default.disable_ipv6=1' | sudo tee -a /etc/sysctl.d/99-cve-2025-21764.conf
sudo sysctl --system

# Restrict unprivileged user namespaces
echo 'kernel.unprivileged_userns_clone=0' | sudo tee -a /etc/sysctl.d/99-cve-2025-21764.conf
sudo sysctl --system