CVE-2025-21762

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21762
In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe Patch
https://git.kernel.org/stable/c/10f555e3f573d004ae9d89b3276abb58c4ede5c3 Patch
https://git.kernel.org/stable/c/2c331718d3389b6c5f6855078ab7171849e016bd Patch
https://git.kernel.org/stable/c/307cd1e2d3cb1cbc6c40c679cada6d7168b18431 Patch
https://git.kernel.org/stable/c/a42b69f692165ec39db42d595f4f65a4c8f42e44 Patch
https://git.kernel.org/stable/c/d9366ac2f956a1948b68c0500f84a3462ff2ed8a Patch
https://git.kernel.org/stable/c/e9f4dee534eb1b225b0a120395ad9bc2afe164d3 Patch
https://git.kernel.org/stable/c/f189654459423d4d48bef2d120b4bfba559e6039 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
History

21 Mar 2025, 18:02

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe - () https://git.kernel.org/stable/c/01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe - Patch
References () https://git.kernel.org/stable/c/10f555e3f573d004ae9d89b3276abb58c4ede5c3 - () https://git.kernel.org/stable/c/10f555e3f573d004ae9d89b3276abb58c4ede5c3 - Patch
References () https://git.kernel.org/stable/c/2c331718d3389b6c5f6855078ab7171849e016bd - () https://git.kernel.org/stable/c/2c331718d3389b6c5f6855078ab7171849e016bd - Patch
References () https://git.kernel.org/stable/c/307cd1e2d3cb1cbc6c40c679cada6d7168b18431 - () https://git.kernel.org/stable/c/307cd1e2d3cb1cbc6c40c679cada6d7168b18431 - Patch
References () https://git.kernel.org/stable/c/a42b69f692165ec39db42d595f4f65a4c8f42e44 - () https://git.kernel.org/stable/c/a42b69f692165ec39db42d595f4f65a4c8f42e44 - Patch
References () https://git.kernel.org/stable/c/d9366ac2f956a1948b68c0500f84a3462ff2ed8a - () https://git.kernel.org/stable/c/d9366ac2f956a1948b68c0500f84a3462ff2ed8a - Patch
References () https://git.kernel.org/stable/c/e9f4dee534eb1b225b0a120395ad9bc2afe164d3 - () https://git.kernel.org/stable/c/e9f4dee534eb1b225b0a120395ad9bc2afe164d3 - Patch
References () https://git.kernel.org/stable/c/f189654459423d4d48bef2d120b4bfba559e6039 - () https://git.kernel.org/stable/c/f189654459423d4d48bef2d120b4bfba559e6039 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux

13 Mar 2025, 13:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arp: usar protección RCU en arp_xmit(). Se puede llamar a arp_xmit() sin protección RTNL o RCU. Use protección RCU para evitar posibles UAF.
References
  • () https://git.kernel.org/stable/c/10f555e3f573d004ae9d89b3276abb58c4ede5c3 -
  • () https://git.kernel.org/stable/c/307cd1e2d3cb1cbc6c40c679cada6d7168b18431 -
  • () https://git.kernel.org/stable/c/d9366ac2f956a1948b68c0500f84a3462ff2ed8a -

27 Feb 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

27 Feb 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 03:15

Updated : 2025-03-21 18:02

NVD link : CVE-2025-21762

Mitre link : CVE-2025-21762

CVE.ORG link : CVE-2025-21762

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free