CVE-2025-21858: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21858 Overview

CVE-2025-21858 is a use-after-free vulnerability in the Linux kernel's GENEVE (Generic Network Virtualization Encapsulation) driver, specifically within the geneve_find_dev() function. This memory corruption flaw occurs due to improper handling of network namespace associations when creating GENEVE tunnel devices. The vulnerability was identified through syzkaller fuzzing and can lead to local privilege escalation or system instability.

Critical Impact
A local attacker with low privileges can exploit this use-after-free condition to potentially execute arbitrary code in kernel context, escalate privileges, or cause denial of service through system crashes.

Affected Products

Linux Kernel versions prior to patched releases
Linux Kernel 6.14-rc1, 6.14-rc2, 6.14-rc3
Multiple stable kernel branches requiring backported fixes

Discovery Timeline

2025-03-12 - CVE CVE-2025-21858 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-21858

Vulnerability Analysis

This use-after-free vulnerability exists in the GENEVE tunnel driver's device lookup mechanism. The flaw stems from a mismatch between network namespaces during device creation and destruction. When a GENEVE device is created with network namespace redirection attributes (IFLA_NET_NS_PID, IFLA_NET_NS_FD, or IFLA_TARGET_NETNSID), the device's geneve_dev.next pointer is linked to a list in a different namespace than the device itself resides in.

During namespace teardown via geneve_exit_batch_rtnl(), the device is unregistered and freed from its home namespace, but the geneve_dev.next pointer remains dangling in the backend UDP socket namespace's geneve list. Subsequent GENEVE device creation in that namespace traverses this corrupted list, accessing freed memory in geneve_find_dev() at line 1295 of drivers/net/geneve.c.

Root Cause

The root cause is improper lifecycle management of the geneve_dev.next linked list pointer across network namespaces. The geneve_configure() function links the device structure to net_generic(net, geneve_net_id)->geneve_list, where net can differ from dev_net(dev) when namespace attributes are specified. When the device's actual namespace is destroyed, geneve_destroy_tunnels() fails to properly unlink the device from the alternate namespace's list before freeing the device memory.

Attack Vector

The vulnerability requires local access and low privileges. An attacker can exploit this by:

Creating a GENEVE tunnel device with cross-namespace configuration using netlink attributes
Triggering destruction of the device's home network namespace
Creating another GENEVE device in the original backend namespace
The new device creation traverses the corrupted list, accessing freed memory

The KASAN-detected access shows a 2-byte read from freed slab memory during the geneve_configure() call path, indicating list traversal of deallocated structures.

Detection Methods for CVE-2025-21858

Indicators of Compromise

KASAN (Kernel Address Sanitizer) reports showing slab-use-after-free in geneve_find_dev or geneve_configure
Kernel panic or oops messages referencing drivers/net/geneve.c with memory access violations
Unexpected system crashes during GENEVE tunnel creation in multi-namespace environments

Detection Strategies

Enable KASAN on development and testing kernels to detect memory corruption attempts
Monitor kernel logs (dmesg) for UAF reports in the GENEVE driver subsystem
Implement audit rules for netlink operations involving network namespace manipulation

Monitoring Recommendations

Deploy kernel live patching solutions to receive immediate protection
Monitor for unusual patterns of network namespace creation and destruction
Track GENEVE device creation events across namespaces using eBPF tracing

How to Mitigate CVE-2025-21858

Immediate Actions Required

Update to patched Linux kernel versions immediately
Review systems using GENEVE tunneling with cross-namespace configurations
Consider temporarily disabling GENEVE module on high-security systems if patching is delayed
Apply vendor-specific security updates from distribution maintainers

Patch Information

The fix modifies geneve_destroy_tunnels() to call geneve_dellink() instead of directly unregistering devices, ensuring proper unlinking from all namespace lists before device destruction. Patches have been committed to the stable kernel tree across multiple branches:

Debian has also issued security announcements for LTS releases. See the Debian LTS Security Announcements for distribution-specific guidance.

Workarounds

Restrict access to network namespace creation capabilities (CAP_SYS_ADMIN or CAP_NET_ADMIN)
Use network policy to limit which users can create GENEVE devices
Monitor and limit cross-namespace GENEVE configurations until patches are applied

bash

# Temporarily disable GENEVE module loading if not required
echo "blacklist geneve" >> /etc/modprobe.d/blacklist-geneve.conf
modprobe -r geneve

# Verify module is not loaded
lsmod | grep geneve