CVE-2025-21791: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21791 Overview

CVE-2025-21791 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Virtual Routing and Forwarding (VRF) subsystem. The flaw resides in the l3mdev_l3_out() function, which the kernel can invoke without holding a Read-Copy-Update (RCU) lock. The unprotected call path originates from raw_sendmsg() and traverses ip_push_pending_frames(), ip_send_skb(), ip_local_out(), __ip_local_out(), and l3mdev_ip_out(). Without RCU protection, a concurrent update to the L3 master device can free memory still referenced by the outgoing packet path. A local unprivileged user with the ability to send raw packets can trigger the condition.

Critical Impact
A local attacker can exploit the use-after-free in the VRF layer to corrupt kernel memory, potentially leading to privilege escalation or a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel versions prior to the fix commits on stable branches
Linux kernel 6.14-rc1 and 6.14-rc2
Debian LTS distributions (advisories issued March 2025 and May 2025)

Discovery Timeline

2025-02-27 - CVE-2025-21791 published to the National Vulnerability Database
2025-03 - Debian LTS security advisory released
2025-05 - Follow-up Debian LTS security advisory released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21791

Vulnerability Analysis

The Linux kernel VRF driver exposes l3mdev_l3_out() as a hook that redirects outbound IP traffic through a virtual routing instance. The function dereferences the L3 master device pointer associated with a socket's outbound path. Because the caller does not consistently hold the RCU read lock, the device can be freed by a concurrent teardown while the reference is still in use. The result is a classic use-after-free on the network transmit path.

The upstream patch resolves the issue by wrapping the affected access with an rcu_read_lock() / rcu_read_unlock() pair. This ensures the referenced device cannot be released while the outbound send path is executing. See the fix commits at Kernel Git Commit 6ccaa579 and Kernel Git Commit c7574740.

Root Cause

The root cause is a missing RCU read-side critical section around access to the L3 master device inside l3mdev_l3_out(). RCU is the kernel's primary mechanism for safe concurrent access to network device structures. Without it, the writer path is free to release the device object between the lookup and the dereference performed on the outbound packet.

Attack Vector

Exploitation requires local access and the ability to send packets through a socket that traverses a VRF-enabled interface. An attacker triggers raw_sendmsg() on such a socket while another thread performs operations that free the associated L3 master device. Winning the race produces a use-after-free in kernel context. Successful exploitation can corrupt kernel memory, crash the system, or provide a primitive for privilege escalation. The vulnerability is not remotely exploitable and no public proof-of-concept has been published.

No verified exploit code is available. Refer to the upstream commits referenced above for the precise semantic change introduced by the fix.

Detection Methods for CVE-2025-21791

Indicators of Compromise

Unexplained kernel oops or panic messages referencing l3mdev_l3_out, l3mdev_ip_out, or __ip_local_out in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the VRF or L3 master device code paths
Repeated crash-and-restart cycles on hosts running VRF-enabled networking

Detection Strategies

Inventory Linux hosts running affected kernel versions and identify systems where VRF is configured (ip vrf show)
Monitor for anomalous raw_sendmsg() usage from non-root processes with CAP_NET_RAW
Correlate kernel crash telemetry with VRF configuration changes occurring in a narrow time window

Monitoring Recommendations

Ingest kernel logs and audit records into a centralized analytics platform for cross-host correlation
Alert on repeated segmentation faults or kernel oops originating from network transmit paths
Track processes that hold CAP_NET_RAW and open SOCK_RAW sockets on hosts with VRF interfaces

How to Mitigate CVE-2025-21791

Immediate Actions Required

Apply the stable kernel updates that include the RCU protection fix as soon as vendor packages are available
Update Debian systems using the packages referenced in the Debian LTS Advisory March 2025 and Debian LTS Advisory May 2025
Restrict CAP_NET_RAW to trusted users and service accounts to reduce the local attack surface

Patch Information

The fix has been merged across multiple stable kernel branches. Reference the upstream commits: 022cac1c, 20a3489b, 5bb4228c, 6ccaa579, 6d0ce46a, 7b81425b, c40cb5c0, and c7574740. Rebuild custom kernels against a fixed stable tag and reboot affected hosts.

Workarounds

Disable VRF interfaces on hosts that do not require multi-tenant routing separation
Remove CAP_NET_RAW from unprivileged users and containers where raw socket access is not needed
Enforce seccomp or AppArmor profiles that block SOCK_RAW socket creation for untrusted workloads

bash

# Verify installed kernel version and reboot after patching
uname -r
apt-get update && apt-get install --only-upgrade linux-image-$(uname -r | sed 's/[^-]*-[^-]*-//')
systemctl reboot

# Audit which processes hold CAP_NET_RAW
getcap -r / 2>/dev/null | grep cap_net_raw

# List VRF devices present on the host
ip -d link show type vrf