CVE-2025-21812: Linux Kernel Race Condition Vulnerability

CVE-2025-21812 Overview

CVE-2025-21812 is a use-after-free vulnerability [CWE-416] in the Linux kernel's AX.25 amateur radio networking subsystem. The flaw resides in the ax25_setsockopt() function within net/ax25/af_ax25.c. Google's syzbot fuzzer detected a circular locking dependency between the rtnl_mutex and the sk_lock-AF_AX25 socket lock. The improper synchronization on dev->ax25_ptr creates conditions for multiple use-after-free scenarios in the AX.25 stack. Local unprivileged users can trigger the flaw to cause memory corruption or potentially escalate privileges on affected Linux systems.

Critical Impact
Local attackers can trigger memory corruption in the AX.25 subsystem, leading to potential privilege escalation, kernel crashes, or arbitrary code execution in kernel context.

Affected Products

Linux Kernel (multiple stable branches prior to fixed commits)
Debian LTS distributions shipping vulnerable kernel versions
Any Linux distribution with the AX.25 protocol module enabled

Discovery Timeline

2025-02-27 - CVE-2025-21812 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21812

Vulnerability Analysis

The vulnerability exists in the AX.25 socket options handler in the Linux kernel. When ax25_setsockopt() acquires the socket lock sk_lock-AF_AX25 and then attempts to acquire rtnl_mutex, it creates an inverse locking order relative to the network device notifier path. The device notifier path acquires rtnl_mutex first, then calls ax25_device_event() which acquires the socket lock through ax25_kill_by_device().

This circular dependency produces a classic ABBA deadlock scenario detected by lockdep. Beyond the deadlock risk, the unsafe access to dev->ax25_ptr without RCU protection permits use-after-free conditions. An attacker manipulating network device state concurrent with socket option calls can dereference freed memory.

The fix removes the RTNL dependency in ax25_setsockopt() and switches dev->ax25_ptr accesses to RCU-protected reads. This eliminates both the lockdep warning and the underlying UAF conditions.

Root Cause

The root cause is missing RCU (Read-Copy-Update) protection on the dev->ax25_ptr pointer combined with inverted lock ordering between sk_lock-AF_AX25 and rtnl_mutex. AX.25 device state could be freed by a concurrent notifier while ax25_setsockopt() held a stale reference.

Attack Vector

Exploitation requires local access with the ability to create AX.25 sockets. An attacker races socket option operations against network device state changes such as interface flag modifications via ioctl(). Successful races cause the kernel to dereference freed memory in the AX.25 subsystem, resulting in kernel memory corruption or crash.

No verified proof-of-concept code is publicly available for CVE-2025-21812. The vulnerability was surfaced through syzbot's automated lockdep instrumentation rather than a targeted exploit. Refer to the Kernel.org commit fixing the flaw for the technical patch details.

Detection Methods for CVE-2025-21812

Indicators of Compromise

Kernel panics or general protection fault messages referencing ax25_setsockopt or ax25_device_event in dmesg output
Lockdep warnings citing sk_lock-AF_AX25 and rtnl_mutex circular dependencies
Unexpected process termination for programs using AF_AX25 sockets
Presence of the ax25 kernel module loaded on systems that do not require amateur radio protocols

Detection Strategies

Audit systems for loaded AX.25 modules using lsmod | grep ax25 and inventory hosts with the protocol enabled
Monitor kernel logs for unexpected WARNING or BUG traces originating in net/ax25/
Track running kernel versions against the fixed commits published on git.kernel.org
Deploy syscall telemetry to identify anomalous setsockopt calls against AF_AX25 sockets from unprivileged users

Monitoring Recommendations

Enable kernel audit rules for socket() syscalls with the AF_AX25 family (address family 3)
Forward dmesg and journald kernel messages to a centralized logging pipeline for anomaly review
Alert on any local user process invoking setsockopt on AX.25 sockets in production environments
Correlate kernel crash telemetry with recent local user activity for post-incident triage

How to Mitigate CVE-2025-21812

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisories on git.kernel.org or update to a patched distribution kernel
On Debian systems, install the fixed kernel package announced in the Debian LTS Security Announcement
Blacklist the ax25 kernel module on systems that do not require amateur radio protocol support
Restrict local shell access on multi-user systems until patched kernels are deployed

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Relevant commits include 2802ed4ced27, 7705d8a7f2c2, 8937f5e38a21, 95fc45d1dea8, and c2531db6de3c. See the Kernel.org stable tree for the reference commit. Distribution vendors have backported these fixes to supported LTS kernels.

Workarounds

Blacklist the AX.25 module by adding blacklist ax25 to /etc/modprobe.d/blacklist-ax25.conf and rebuilding the initramfs
Prevent module autoloading with install ax25 /bin/true in a modprobe configuration file
Restrict CAP_NET_RAW and unprivileged socket creation via seccomp or LSM policy where feasible
Remove the ax25 kernel module from the running system with rmmod ax25 if no active sessions depend on it

bash

# Configuration example: prevent AX.25 module from loading
echo "install ax25 /bin/true" | sudo tee /etc/modprobe.d/disable-ax25.conf
echo "blacklist ax25" | sudo tee -a /etc/modprobe.d/disable-ax25.conf
sudo update-initramfs -u
# Verify module is not loaded
lsmod | grep ax25