Executive brief
A vulnerability in the Linux kernel's networking component could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue exists in how the system handles IPv6 neighbor discovery, a fundamental process for network communication. This could impact the stability and security of servers and workstations running affected versions of Linux.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's ndisc_alloc_skb() function within the IPv6 Neighbor Discovery (ndisc) protocol implementation. The root cause is a lack of RCU (Read-Copy-Update) or RTNL (Routing Netlink) locking when accessing the ndisc socket, allowing the socket object to be freed while still in use. A local attacker with low privileges can exploit this race condition to trigger memory corruption. This can result in a kernel panic (denial of service) or potentially arbitrary code execution with kernel privileges. Patches have been released across multiple stable kernel branches to implement proper RCU protection.
Affected products
- Linux Linux Kernel 3.9 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4
Timeline
- 2025-02-07: patched: Initial fix authored by Eric Dumazet
- 2025-02-26: disclosed: CVE-2025-21764 assigned and published
- 2025-02-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/3c2d705f5adf5d860aaef90cb4211c0fde2ba66d
- https://git.kernel.org/stable/c/628e6d18930bbd21f2d4562228afe27694f66da9
- https://git.kernel.org/stable/c/96fc896d0e5b37c12808df797397fb16f3080879
- https://git.kernel.org/stable/c/9e0ec817eb41a55327a46cd3ce331a9868d60304
- https://git.kernel.org/stable/c/b870256dd2a5648d5ed2f22316b3ac29a7e5ed63
- https://git.kernel.org/stable/c/bbec88e4108e8d6fb468d3817fa652140a44ff28
- https://git.kernel.org/stable/c/c30893ef3d9cde8e7e8e4fd06b53d2c935bbccb1