Junglewise Threat Intelligence

CVE-2025-21762: Linux Kernel use-after-free in arp_xmit

CVE-2025-21762 · Severity: high · CVSS 7.8 · Published 2025-02-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability has been identified in the Linux kernel's networking component that handles Address Resolution Protocol (ARP) traffic. This flaw could allow a local attacker to cause a system crash or potentially execute unauthorized actions by exploiting a memory management error. The issue affects a wide range of Linux distributions and has been addressed in recent security updates.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's 'net/ipv4/arp.c' component. The function 'arp_xmit()' can be invoked without the necessary RTNL (Routing Netlink) or RCU (Read-Copy-Update) locks, leading to a race condition where network device structures may be freed while still in use by the ARP transmission path. An attacker with local access could exploit this to trigger a kernel panic or achieve arbitrary code execution. The fix introduces 'rcu_read_lock()' and 'rcu_read_unlock()' around the 'NF_HOOK' call and utilizes 'dev_net_rcu()' to ensure safe access to network namespaces.

Affected products

  • Linux Linux Kernel 4.4 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4

Timeline

  • 2025-02-07: patched: Initial patch authored by Eric Dumazet
  • 2025-02-26: disclosed: CVE assigned and published
  • 2025-02-27: advisory: NVD and CISA-ADP enrichment provided

References

Related threats