CVE-2025-21764

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21764
In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() can be called without RTNL or RCU being held. Add RCU protection to avoid possible UAF.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3c2d705f5adf5d860aaef90cb4211c0fde2ba66d Patch
https://git.kernel.org/stable/c/628e6d18930bbd21f2d4562228afe27694f66da9 Patch
https://git.kernel.org/stable/c/96fc896d0e5b37c12808df797397fb16f3080879 Patch
https://git.kernel.org/stable/c/9e0ec817eb41a55327a46cd3ce331a9868d60304 Patch
https://git.kernel.org/stable/c/b870256dd2a5648d5ed2f22316b3ac29a7e5ed63 Patch
https://git.kernel.org/stable/c/bbec88e4108e8d6fb468d3817fa652140a44ff28 Patch
https://git.kernel.org/stable/c/c30893ef3d9cde8e7e8e4fd06b53d2c935bbccb1 Patch
https://git.kernel.org/stable/c/cd1065f92eb7ff21b9ba5308a86f33d1670bf926 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
History

21 Mar 2025, 15:44

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3c2d705f5adf5d860aaef90cb4211c0fde2ba66d - () https://git.kernel.org/stable/c/3c2d705f5adf5d860aaef90cb4211c0fde2ba66d - Patch
References () https://git.kernel.org/stable/c/628e6d18930bbd21f2d4562228afe27694f66da9 - () https://git.kernel.org/stable/c/628e6d18930bbd21f2d4562228afe27694f66da9 - Patch
References () https://git.kernel.org/stable/c/96fc896d0e5b37c12808df797397fb16f3080879 - () https://git.kernel.org/stable/c/96fc896d0e5b37c12808df797397fb16f3080879 - Patch
References () https://git.kernel.org/stable/c/9e0ec817eb41a55327a46cd3ce331a9868d60304 - () https://git.kernel.org/stable/c/9e0ec817eb41a55327a46cd3ce331a9868d60304 - Patch
References () https://git.kernel.org/stable/c/b870256dd2a5648d5ed2f22316b3ac29a7e5ed63 - () https://git.kernel.org/stable/c/b870256dd2a5648d5ed2f22316b3ac29a7e5ed63 - Patch
References () https://git.kernel.org/stable/c/bbec88e4108e8d6fb468d3817fa652140a44ff28 - () https://git.kernel.org/stable/c/bbec88e4108e8d6fb468d3817fa652140a44ff28 - Patch
References () https://git.kernel.org/stable/c/c30893ef3d9cde8e7e8e4fd06b53d2c935bbccb1 - () https://git.kernel.org/stable/c/c30893ef3d9cde8e7e8e4fd06b53d2c935bbccb1 - Patch
References () https://git.kernel.org/stable/c/cd1065f92eb7ff21b9ba5308a86f33d1670bf926 - () https://git.kernel.org/stable/c/cd1065f92eb7ff21b9ba5308a86f33d1670bf926 - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

13 Mar 2025, 13:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ndisc: usar protección RCU en ndisc_alloc_skb() ndisc_alloc_skb() se puede llamar sin que se mantenga RTNL o RCU. Agregue protección RCU para evitar posibles UAF.
References
  • () https://git.kernel.org/stable/c/96fc896d0e5b37c12808df797397fb16f3080879 -
  • () https://git.kernel.org/stable/c/b870256dd2a5648d5ed2f22316b3ac29a7e5ed63 -
  • () https://git.kernel.org/stable/c/c30893ef3d9cde8e7e8e4fd06b53d2c935bbccb1 -

27 Feb 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

27 Feb 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 03:15

Updated : 2025-03-21 15:44

NVD link : CVE-2025-21764

Mitre link : CVE-2025-21764

CVE.ORG link : CVE-2025-21764

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free