Junglewise Threat Intelligence

CVE-2025-21766: Linux Kernel use-after-free in IPv4 PMTU update

CVE-2025-21766 · Severity: medium · CVSS 5.5 · Published 2025-02-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local attacker to cause a system crash. The issue occurs when the system updates network path information, potentially accessing memory that has already been freed. This primarily impacts system availability and could lead to a denial-of-service condition on affected servers or workstations.

Technical details

A vulnerability was identified in the Linux kernel's IPv4 implementation within the __ip_rt_update_pmtu() function. The function failed to properly use Read-Copy-Update (RCU) protection when accessing the 'net' structure, creating a race condition where the structure could be deleted while still being read. An attacker with local access could potentially trigger this race condition to cause a kernel panic or null pointer dereference. The fix involves wrapping the network namespace access and subsequent lookups within rcu_read_lock() and rcu_read_unlock() blocks to ensure the data structures remain valid during the operation. Patches have been released for multiple stable kernel branches including 6.13.4, 6.12.16, 6.6.79, and 6.1.129.

Affected products

  • Linux Linux Kernel 4.14.200 to 4.15, 4.19.148 to 4.20, 5.4.68 to 5.5, 5.8.12 to 5.9, 5.9.1 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4, 6.14-rc1, 6.14-rc2

Timeline

  • 2025-02-05: patched: Initial patch authored by Eric Dumazet
  • 2025-02-26: advisory: NVD Published Date
  • 2025-02-27: disclosed

References

Related threats