CVE-2025-21764

HIGH

Linux Kernel - Use-After-Free in ndisc_alloc_skb

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() can be called without RTNL or RCU being held. Add RCU protection to avoid possible UAF.

References (11)

Core 11
Core References

Scores

CVSS v3 7.8
EPSS 0.0023
EPSS Percentile 13.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-416
Status published
Products (27)
linux/Kernel 3.9.0 - 5.4.291linux
linux/Kernel 5.11.0 - 5.15.179linux
linux/Kernel 5.16.0 - 6.1.129linux
linux/Kernel 5.5.0 - 5.10.235linux
linux/Kernel 6.13.0 - 6.13.4linux
linux/Kernel 6.2.0 - 6.6.79linux
linux/Kernel 6.7.0 - 6.12.16linux
Linux/Linux < 3.9
Linux/Linux 3.9
Linux/Linux 5.10.235 - 5.10.*
... and 17 more
Published Feb 27, 2025
Tracked Since Feb 18, 2026