Vulnerability-Lookup

CERTFR-2025-AVI-0463

Vulnerability from certfr_avis - Published: 2025-05-30 - Updated: 2025-05-30

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Debian	Debian	Debian LTS bullseye versions antérieures à 6.1.137-1~deb11u1
	Debian	Debian	Debian LTS bullseye versions antérieures à 5.10.237-1

References

Title

Publication Time

CVE-2025-21736 (GCVE-0-2025-21736)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-05-11 21:05

Title

nilfs2: fix possible int overflows in nilfs_fiemap()

Summary

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix possible int overflows in nilfs_fiemap() Since nilfs_bmap_lookup_contig() in nilfs_fiemap() calculates its result by being prepared to go through potentially maxblocks == INT_MAX blocks, the value in n may experience an overflow caused by left shift of blkbits. While it is extremely unlikely to occur, play it safe and cast right hand expression to wider type to mitigate the issue. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/7649937987fed51ed…
https://git.kernel.org/stable/c/58b1c6881081f5ddf…
https://git.kernel.org/stable/c/8f41df5fd4c11d26e…
https://git.kernel.org/stable/c/f3d80f34f58445355…
https://git.kernel.org/stable/c/f2bd0f1ab47822fe5…
https://git.kernel.org/stable/c/b9495a9109abc31d3…
https://git.kernel.org/stable/c/250423300b4b03359…
https://git.kernel.org/stable/c/6438ef381c183444f…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 622daaff0a8975fb5c5b95f24f3234550ba32e92 , < 7649937987fed51ed09985da4019d50189fc534e (git) Affected: 622daaff0a8975fb5c5b95f24f3234550ba32e92 , < 58b1c6881081f5ddfb9a14dc241a74732c0f855c (git) Affected: 622daaff0a8975fb5c5b95f24f3234550ba32e92 , < 8f41df5fd4c11d26e929a85f7239799641f92da7 (git) Affected: 622daaff0a8975fb5c5b95f24f3234550ba32e92 , < f3d80f34f58445355fa27b9579a449fb186aa64e (git) Affected: 622daaff0a8975fb5c5b95f24f3234550ba32e92 , < f2bd0f1ab47822fe5bd699c8458b896c4b2edea1 (git) Affected: 622daaff0a8975fb5c5b95f24f3234550ba32e92 , < b9495a9109abc31d3170f7aad7d48aa64610a1a2 (git) Affected: 622daaff0a8975fb5c5b95f24f3234550ba32e92 , < 250423300b4b0335918be187ef3cade248c06e6a (git) Affected: 622daaff0a8975fb5c5b95f24f3234550ba32e92 , < 6438ef381c183444f7f9d1de18f22661cba1e946 (git)
Linux	Linux	Affected: 2.6.38 Unaffected: 0 , < 2.6.38 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.78 , ≤ 6.6.* (semver) Unaffected: 6.12.14 , ≤ 6.12.* (semver) Unaffected: 6.13.3 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:43.129Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7649937987fed51ed09985da4019d50189fc534e",
              "status": "affected",
              "version": "622daaff0a8975fb5c5b95f24f3234550ba32e92",
              "versionType": "git"
            },
            {
              "lessThan": "58b1c6881081f5ddfb9a14dc241a74732c0f855c",
              "status": "affected",
              "version": "622daaff0a8975fb5c5b95f24f3234550ba32e92",
              "versionType": "git"
            },
            {
              "lessThan": "8f41df5fd4c11d26e929a85f7239799641f92da7",
              "status": "affected",
              "version": "622daaff0a8975fb5c5b95f24f3234550ba32e92",
              "versionType": "git"
            },
            {
              "lessThan": "f3d80f34f58445355fa27b9579a449fb186aa64e",
              "status": "affected",
              "version": "622daaff0a8975fb5c5b95f24f3234550ba32e92",
              "versionType": "git"
            },
            {
              "lessThan": "f2bd0f1ab47822fe5bd699c8458b896c4b2edea1",
              "status": "affected",
              "version": "622daaff0a8975fb5c5b95f24f3234550ba32e92",
              "versionType": "git"
            },
            {
              "lessThan": "b9495a9109abc31d3170f7aad7d48aa64610a1a2",
              "status": "affected",
              "version": "622daaff0a8975fb5c5b95f24f3234550ba32e92",
              "versionType": "git"
            },
            {
              "lessThan": "250423300b4b0335918be187ef3cade248c06e6a",
              "status": "affected",
              "version": "622daaff0a8975fb5c5b95f24f3234550ba32e92",
              "versionType": "git"
            },
            {
              "lessThan": "6438ef381c183444f7f9d1de18f22661cba1e946",
              "status": "affected",
              "version": "622daaff0a8975fb5c5b95f24f3234550ba32e92",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix possible int overflows in nilfs_fiemap()\n\nSince nilfs_bmap_lookup_contig() in nilfs_fiemap() calculates its result\nby being prepared to go through potentially maxblocks == INT_MAX blocks,\nthe value in n may experience an overflow caused by left shift of blkbits.\n\nWhile it is extremely unlikely to occur, play it safe and cast right hand\nexpression to wider type to mitigate the issue.\n\nFound by Linux Verification Center (linuxtesting.org) with static analysis\ntool SVACE."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:05:26.846Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7649937987fed51ed09985da4019d50189fc534e"
        },
        {
          "url": "https://git.kernel.org/stable/c/58b1c6881081f5ddfb9a14dc241a74732c0f855c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f41df5fd4c11d26e929a85f7239799641f92da7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3d80f34f58445355fa27b9579a449fb186aa64e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2bd0f1ab47822fe5bd699c8458b896c4b2edea1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9495a9109abc31d3170f7aad7d48aa64610a1a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/250423300b4b0335918be187ef3cade248c06e6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6438ef381c183444f7f9d1de18f22661cba1e946"
        }
      ],
      "title": "nilfs2: fix possible int overflows in nilfs_fiemap()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21736",
    "datePublished": "2025-02-27T02:12:12.871Z",
    "dateReserved": "2024-12-29T08:45:45.756Z",
    "dateUpdated": "2026-05-11T21:05:26.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21744 (GCVE-0-2025-21744)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-05-23 15:57

Title

wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() On removal of the device or unloading of the kernel module a potential NULL pointer dereference occurs. The following sequence deletes the interface: brcmf_detach() brcmf_remove_interface() brcmf_del_if() Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to BRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches. After brcmf_remove_interface() call the brcmf_proto_detach() function is called providing the following sequence: brcmf_detach() brcmf_proto_detach() brcmf_proto_msgbuf_detach() brcmf_flowring_detach() brcmf_msgbuf_delete_flowring() brcmf_msgbuf_remove_flowring() brcmf_flowring_delete() brcmf_get_ifp() brcmf_txfinalize() Since brcmf_get_ip() can and actually will return NULL in this case the call to brcmf_txfinalize() will result in a NULL pointer dereference inside brcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors. This will only happen if a flowring still has an skb. Although the NULL pointer dereference has only been seen when trying to update the tx statistic, all other uses of the ifp pointer have been guarded as well with an early return if ifp is NULL.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/2326e19190e176fd7…
https://git.kernel.org/stable/c/59ff4fa653ff6db07…
https://git.kernel.org/stable/c/61541d9b5a23df339…
https://git.kernel.org/stable/c/4e51d6d093e763348…
https://git.kernel.org/stable/c/3877fc67bd3d5566c…
https://git.kernel.org/stable/c/fbbfef2a5b858eab5…
https://git.kernel.org/stable/c/a2beefc4fa49ebc22…
https://git.kernel.org/stable/c/68abd0c4ebf24cd49…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 7f00ee2bbc630900ba16fc2690473f3e2db0e264 , < 2326e19190e176fd72bb542b837a9d2b7fcb8693 (git) Affected: 7f00ee2bbc630900ba16fc2690473f3e2db0e264 , < 59ff4fa653ff6db07c61152516ffba79c2a74bda (git) Affected: 7f00ee2bbc630900ba16fc2690473f3e2db0e264 , < 61541d9b5a23df33934fcc620a3a81f246b1b240 (git) Affected: 7f00ee2bbc630900ba16fc2690473f3e2db0e264 , < 4e51d6d093e763348916e69d06d87e0a5593661b (git) Affected: 7f00ee2bbc630900ba16fc2690473f3e2db0e264 , < 3877fc67bd3d5566cc12763bce39710ceb74a97d (git) Affected: 7f00ee2bbc630900ba16fc2690473f3e2db0e264 , < fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58 (git) Affected: 7f00ee2bbc630900ba16fc2690473f3e2db0e264 , < a2beefc4fa49ebc22e664dc6b39dbd054f8488f9 (git) Affected: 7f00ee2bbc630900ba16fc2690473f3e2db0e264 , < 68abd0c4ebf24cd499841a488b97a6873d5efabb (git) Affected: 6faa698c35a43b9e74ea24e90fe37471d08d00d0 (git) Affected: 9119232cc92a269d7860b4aa51f07d3923a3cc10 (git) Affected: 4.7.10 , < 4.8 (semver) Affected: 4.8.4 , < 4.9 (semver)
Linux	Linux	Affected: 4.9 Unaffected: 0 , < 4.9 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.78 , ≤ 6.6.* (semver) Unaffected: 6.12.14 , ≤ 6.12.* (semver) Unaffected: 6.13.3 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:47.312Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:03:34.427Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2326e19190e176fd72bb542b837a9d2b7fcb8693",
              "status": "affected",
              "version": "7f00ee2bbc630900ba16fc2690473f3e2db0e264",
              "versionType": "git"
            },
            {
              "lessThan": "59ff4fa653ff6db07c61152516ffba79c2a74bda",
              "status": "affected",
              "version": "7f00ee2bbc630900ba16fc2690473f3e2db0e264",
              "versionType": "git"
            },
            {
              "lessThan": "61541d9b5a23df33934fcc620a3a81f246b1b240",
              "status": "affected",
              "version": "7f00ee2bbc630900ba16fc2690473f3e2db0e264",
              "versionType": "git"
            },
            {
              "lessThan": "4e51d6d093e763348916e69d06d87e0a5593661b",
              "status": "affected",
              "version": "7f00ee2bbc630900ba16fc2690473f3e2db0e264",
              "versionType": "git"
            },
            {
              "lessThan": "3877fc67bd3d5566cc12763bce39710ceb74a97d",
              "status": "affected",
              "version": "7f00ee2bbc630900ba16fc2690473f3e2db0e264",
              "versionType": "git"
            },
            {
              "lessThan": "fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58",
              "status": "affected",
              "version": "7f00ee2bbc630900ba16fc2690473f3e2db0e264",
              "versionType": "git"
            },
            {
              "lessThan": "a2beefc4fa49ebc22e664dc6b39dbd054f8488f9",
              "status": "affected",
              "version": "7f00ee2bbc630900ba16fc2690473f3e2db0e264",
              "versionType": "git"
            },
            {
              "lessThan": "68abd0c4ebf24cd499841a488b97a6873d5efabb",
              "status": "affected",
              "version": "7f00ee2bbc630900ba16fc2690473f3e2db0e264",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6faa698c35a43b9e74ea24e90fe37471d08d00d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9119232cc92a269d7860b4aa51f07d3923a3cc10",
              "versionType": "git"
            },
            {
              "lessThan": "4.8",
              "status": "affected",
              "version": "4.7.10",
              "versionType": "semver"
            },
            {
              "lessThan": "4.9",
              "status": "affected",
              "version": "4.8.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.7.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.8.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()\n\nOn removal of the device or unloading of the kernel module a potential NULL\npointer dereference occurs.\n\nThe following sequence deletes the interface:\n\n  brcmf_detach()\n    brcmf_remove_interface()\n      brcmf_del_if()\n\nInside the brcmf_del_if() function the drvr-\u003eif2bss[ifidx] is updated to\nBRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches.\n\nAfter brcmf_remove_interface() call the brcmf_proto_detach() function is\ncalled providing the following sequence:\n\n  brcmf_detach()\n    brcmf_proto_detach()\n      brcmf_proto_msgbuf_detach()\n        brcmf_flowring_detach()\n          brcmf_msgbuf_delete_flowring()\n            brcmf_msgbuf_remove_flowring()\n              brcmf_flowring_delete()\n                brcmf_get_ifp()\n                brcmf_txfinalize()\n\nSince brcmf_get_ip() can and actually will return NULL in this case the\ncall to brcmf_txfinalize() will result in a NULL pointer dereference inside\nbrcmf_txfinalize() when trying to update ifp-\u003endev-\u003estats.tx_errors.\n\nThis will only happen if a flowring still has an skb.\n\nAlthough the NULL pointer dereference has only been seen when trying to\nupdate the tx statistic, all other uses of the ifp pointer have been\nguarded as well with an early return if ifp is NULL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:57:03.732Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2326e19190e176fd72bb542b837a9d2b7fcb8693"
        },
        {
          "url": "https://git.kernel.org/stable/c/59ff4fa653ff6db07c61152516ffba79c2a74bda"
        },
        {
          "url": "https://git.kernel.org/stable/c/61541d9b5a23df33934fcc620a3a81f246b1b240"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e51d6d093e763348916e69d06d87e0a5593661b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3877fc67bd3d5566cc12763bce39710ceb74a97d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2beefc4fa49ebc22e664dc6b39dbd054f8488f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/68abd0c4ebf24cd499841a488b97a6873d5efabb"
        }
      ],
      "title": "wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21744",
    "datePublished": "2025-02-27T02:12:17.259Z",
    "dateReserved": "2024-12-29T08:45:45.757Z",
    "dateUpdated": "2026-05-23T15:57:03.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21745 (GCVE-0-2025-21745)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-09-08 08:40

Title

blk-cgroup: Fix class @block_class's subsystem refcount leakage

Summary

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with class_dev_iter_exit(), so causes the class's subsystem refcount leakage. Fix by ending the iterating with class_dev_iter_exit().

Severity

No CVSS data available.

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/ffb494f1e7a047bd7…
https://git.kernel.org/stable/c/38287f779b34dfe95…
https://git.kernel.org/stable/c/431b6ef2714be4d5b…
https://git.kernel.org/stable/c/993121481b5a87829…
https://git.kernel.org/stable/c/2ce09aabe009453d6…
https://git.kernel.org/stable/c/67c7f213e052b1aa6…
https://git.kernel.org/stable/c/d1248436cbef1f924…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

9 products

Vendor	Product	Version
Linux	Linux	Affected: ef45fe470e1e5410db4af87abc5d5055427945ac , < ffb494f1e7a047bd7a41b13796fcfb08fe5beafb (git) Affected: ef45fe470e1e5410db4af87abc5d5055427945ac , < 38287f779b34dfe959b4b681e909f2d3d52b88be (git) Affected: ef45fe470e1e5410db4af87abc5d5055427945ac , < 431b6ef2714be4d5babb802114987541a88b43b0 (git) Affected: ef45fe470e1e5410db4af87abc5d5055427945ac , < 993121481b5a87829f1e8163f47158b72679f309 (git) Affected: ef45fe470e1e5410db4af87abc5d5055427945ac , < 2ce09aabe009453d641a2ceb79e6461a2d4f3876 (git) Affected: ef45fe470e1e5410db4af87abc5d5055427945ac , < 67c7f213e052b1aa6caba4a7e25e303bc6997126 (git) Affected: ef45fe470e1e5410db4af87abc5d5055427945ac , < d1248436cbef1f924c04255367ff4845ccd9025e (git)
Linux	Linux	Affected: 5.9 Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.78 , ≤ 6.6.* (semver) Unaffected: 6.12.14 , ≤ 6.12.* (semver) Unaffected: 6.13.3 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:50.044Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:40:28.224Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ffb494f1e7a047bd7a41b13796fcfb08fe5beafb",
              "status": "affected",
              "version": "ef45fe470e1e5410db4af87abc5d5055427945ac",
              "versionType": "git"
            },
            {
              "lessThan": "38287f779b34dfe959b4b681e909f2d3d52b88be",
              "status": "affected",
              "version": "ef45fe470e1e5410db4af87abc5d5055427945ac",
              "versionType": "git"
            },
            {
              "lessThan": "431b6ef2714be4d5babb802114987541a88b43b0",
              "status": "affected",
              "version": "ef45fe470e1e5410db4af87abc5d5055427945ac",
              "versionType": "git"
            },
            {
              "lessThan": "993121481b5a87829f1e8163f47158b72679f309",
              "status": "affected",
              "version": "ef45fe470e1e5410db4af87abc5d5055427945ac",
              "versionType": "git"
            },
            {
              "lessThan": "2ce09aabe009453d641a2ceb79e6461a2d4f3876",
              "status": "affected",
              "version": "ef45fe470e1e5410db4af87abc5d5055427945ac",
              "versionType": "git"
            },
            {
              "lessThan": "67c7f213e052b1aa6caba4a7e25e303bc6997126",
              "status": "affected",
              "version": "ef45fe470e1e5410db4af87abc5d5055427945ac",
              "versionType": "git"
            },
            {
              "lessThan": "d1248436cbef1f924c04255367ff4845ccd9025e",
              "status": "affected",
              "version": "ef45fe470e1e5410db4af87abc5d5055427945ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Fix class @block_class\u0027s subsystem refcount leakage\n\nblkcg_fill_root_iostats() iterates over @block_class\u0027s devices by\nclass_dev_iter_(init|next)(), but does not end iterating with\nclass_dev_iter_exit(), so causes the class\u0027s subsystem refcount leakage.\n\nFix by ending the iterating with class_dev_iter_exit()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:05:36.361Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ffb494f1e7a047bd7a41b13796fcfb08fe5beafb"
        },
        {
          "url": "https://git.kernel.org/stable/c/38287f779b34dfe959b4b681e909f2d3d52b88be"
        },
        {
          "url": "https://git.kernel.org/stable/c/431b6ef2714be4d5babb802114987541a88b43b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/993121481b5a87829f1e8163f47158b72679f309"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ce09aabe009453d641a2ceb79e6461a2d4f3876"
        },
        {
          "url": "https://git.kernel.org/stable/c/67c7f213e052b1aa6caba4a7e25e303bc6997126"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1248436cbef1f924c04255367ff4845ccd9025e"
        }
      ],
      "title": "blk-cgroup: Fix class @block_class\u0027s subsystem refcount leakage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21745",
    "datePublished": "2025-02-27T02:12:17.853Z",
    "dateReserved": "2024-12-29T08:45:45.757Z",
    "dateUpdated": "2026-09-08T08:40:28.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21749 (GCVE-0-2025-21749)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-05-11 21:05

Title

net: rose: lock the socket in rose_bind()

Summary

In the Linux kernel, the following vulnerability has been resolved: net: rose: lock the socket in rose_bind() syzbot reported a soft lockup in rose_loopback_timer(), with a repro calling bind() from multiple threads. rose_bind() must lock the socket to avoid this issue.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/b8bf5c3fb778bbb1f…
https://git.kernel.org/stable/c/ed00c5f907d08a647…
https://git.kernel.org/stable/c/d308661a0f4e7c8e8…
https://git.kernel.org/stable/c/667f61b3498df751c…
https://git.kernel.org/stable/c/e0384efd45f615603…
https://git.kernel.org/stable/c/970cd2ed26cdab2b0…
https://git.kernel.org/stable/c/4c04b0ab3a647e76d…
https://git.kernel.org/stable/c/a1300691aed9ee852…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b8bf5c3fb778bbb1f3ff7d98ec577c969f687513 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ed00c5f907d08a647b8bf987514ad8c6b17971a7 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d308661a0f4e7c8e86dfc7074a55ee5894c61538 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 667f61b3498df751c8b3f0be1637e7226cbe3ed0 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e0384efd45f615603e6869205b72040c209e69cc (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 970cd2ed26cdab2b0f15b6d90d7eaa36538244a5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4c04b0ab3a647e76d0e752b013de8e404abafc63 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a1300691aed9ee852b0a9192e29e2bdc2411a7e6 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.78 , ≤ 6.6.* (semver) Unaffected: 6.12.14 , ≤ 6.12.* (semver) Unaffected: 6.13.3 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:54.163Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rose/af_rose.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b8bf5c3fb778bbb1f3ff7d98ec577c969f687513",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ed00c5f907d08a647b8bf987514ad8c6b17971a7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d308661a0f4e7c8e86dfc7074a55ee5894c61538",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "667f61b3498df751c8b3f0be1637e7226cbe3ed0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e0384efd45f615603e6869205b72040c209e69cc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "970cd2ed26cdab2b0f15b6d90d7eaa36538244a5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4c04b0ab3a647e76d0e752b013de8e404abafc63",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a1300691aed9ee852b0a9192e29e2bdc2411a7e6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rose/af_rose.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rose: lock the socket in rose_bind()\n\nsyzbot reported a soft lockup in rose_loopback_timer(),\nwith a repro calling bind() from multiple threads.\n\nrose_bind() must lock the socket to avoid this issue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:05:41.256Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b8bf5c3fb778bbb1f3ff7d98ec577c969f687513"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed00c5f907d08a647b8bf987514ad8c6b17971a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d308661a0f4e7c8e86dfc7074a55ee5894c61538"
        },
        {
          "url": "https://git.kernel.org/stable/c/667f61b3498df751c8b3f0be1637e7226cbe3ed0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0384efd45f615603e6869205b72040c209e69cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/970cd2ed26cdab2b0f15b6d90d7eaa36538244a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c04b0ab3a647e76d0e752b013de8e404abafc63"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1300691aed9ee852b0a9192e29e2bdc2411a7e6"
        }
      ],
      "title": "net: rose: lock the socket in rose_bind()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21749",
    "datePublished": "2025-02-27T02:12:20.305Z",
    "dateReserved": "2024-12-29T08:45:45.758Z",
    "dateUpdated": "2026-05-11T21:05:41.256Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21753 (GCVE-0-2025-21753)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-08-05 11:54

Title

btrfs: fix use-after-free when attempting to join an aborted transaction

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when attempting to join an aborted transaction When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs_info->trans_lock and without holding any extra reference count on it. This means that a concurrent task that is aborting the transaction may free the transaction before we read its 'aborted' field, leading to a use-after-free. Fix this by reading the 'aborted' field while holding fs_info->trans_lock since any freeing task must first acquire that lock and set fs_info->running_transaction to NULL before freeing the transaction. This was reported by syzbot and Dmitry with the following stack traces from KASAN: ================================================================== BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128 CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_data_space Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803 btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5315: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572 lookup_open fs/namei.c:3649 [inline] open_last_lookups fs/namei.c:3748 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3984 do_filp_open+0x27f/0x4e0 fs/namei.c:4014 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402 do_sys_open fs/open.c:1417 [inline] __do_sys_creat fs/open.c:1495 [inline] __se_sys_creat fs/open.c:1489 [inline] __x64_sys_creat+0x123/0x170 fs/open.c:1489 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5336: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 cleanup_transaction fs/btrfs/transaction.c:2063 [inline] btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598 insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757 btrfs_balance+0x992/ ---truncated---

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-27 18:14 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/cee55b1219568c80b…
https://git.kernel.org/stable/c/c7a53757717e68af9…
https://git.kernel.org/stable/c/7e954b6bb95d67ae4…
https://git.kernel.org/stable/c/6ba4663ada6c6315a…
https://git.kernel.org/stable/c/8f5cff471039caa2b…
https://git.kernel.org/stable/c/86d71a026a7f63da9…
https://git.kernel.org/stable/c/ce628048390dad803…
https://git.kernel.org/stable/c/e2f0943cf37305dbd…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 871383be592ba7e819d27556591e315a0df38cee , < cee55b1219568c80bf0d5dc55066e4a859baf753 (git) Affected: 871383be592ba7e819d27556591e315a0df38cee , < c7a53757717e68af94a56929d57f1e6daff220ec (git) Affected: 871383be592ba7e819d27556591e315a0df38cee , < 7e954b6bb95d67ae4d1a20e9cfd83c182cf929bc (git) Affected: 871383be592ba7e819d27556591e315a0df38cee , < 6ba4663ada6c6315af23a6669d386146634808ec (git) Affected: 871383be592ba7e819d27556591e315a0df38cee , < 8f5cff471039caa2b088060c074c2bf2081bcb01 (git) Affected: 871383be592ba7e819d27556591e315a0df38cee , < 86d71a026a7f63da905db9add845c8ee88801eca (git) Affected: 871383be592ba7e819d27556591e315a0df38cee , < ce628048390dad80320d5a1f74de6ca1e1be91e7 (git) Affected: 871383be592ba7e819d27556591e315a0df38cee , < e2f0943cf37305dbdeaf9846e3c941451bcdef63 (git)
Linux	Linux	Affected: 3.4 Unaffected: 0 , < 3.4 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.78 , ≤ 6.6.* (semver) Unaffected: 6.12.14 , ≤ 6.12.* (semver) Unaffected: 6.13.3 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21753",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:14:22.911957Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:29.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:58.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:03:36.932Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/transaction.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cee55b1219568c80bf0d5dc55066e4a859baf753",
              "status": "affected",
              "version": "871383be592ba7e819d27556591e315a0df38cee",
              "versionType": "git"
            },
            {
              "lessThan": "c7a53757717e68af94a56929d57f1e6daff220ec",
              "status": "affected",
              "version": "871383be592ba7e819d27556591e315a0df38cee",
              "versionType": "git"
            },
            {
              "lessThan": "7e954b6bb95d67ae4d1a20e9cfd83c182cf929bc",
              "status": "affected",
              "version": "871383be592ba7e819d27556591e315a0df38cee",
              "versionType": "git"
            },
            {
              "lessThan": "6ba4663ada6c6315af23a6669d386146634808ec",
              "status": "affected",
              "version": "871383be592ba7e819d27556591e315a0df38cee",
              "versionType": "git"
            },
            {
              "lessThan": "8f5cff471039caa2b088060c074c2bf2081bcb01",
              "status": "affected",
              "version": "871383be592ba7e819d27556591e315a0df38cee",
              "versionType": "git"
            },
            {
              "lessThan": "86d71a026a7f63da905db9add845c8ee88801eca",
              "status": "affected",
              "version": "871383be592ba7e819d27556591e315a0df38cee",
              "versionType": "git"
            },
            {
              "lessThan": "ce628048390dad80320d5a1f74de6ca1e1be91e7",
              "status": "affected",
              "version": "871383be592ba7e819d27556591e315a0df38cee",
              "versionType": "git"
            },
            {
              "lessThan": "e2f0943cf37305dbdeaf9846e3c941451bcdef63",
              "status": "affected",
              "version": "871383be592ba7e819d27556591e315a0df38cee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/transaction.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free when attempting to join an aborted transaction\n\nWhen we are trying to join the current transaction and if it\u0027s aborted,\nwe read its \u0027aborted\u0027 field after unlocking fs_info-\u003etrans_lock and\nwithout holding any extra reference count on it. This means that a\nconcurrent task that is aborting the transaction may free the transaction\nbefore we read its \u0027aborted\u0027 field, leading to a use-after-free.\n\nFix this by reading the \u0027aborted\u0027 field while holding fs_info-\u003etrans_lock\nsince any freeing task must first acquire that lock and set\nfs_info-\u003erunning_transaction to NULL before freeing the transaction.\n\nThis was reported by syzbot and Dmitry with the following stack traces\nfrom KASAN:\n\n   ==================================================================\n   BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278\n   Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128\n\n   CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0\n   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n   Workqueue: events_unbound btrfs_async_reclaim_data_space\n   Call Trace:\n    \u003cTASK\u003e\n    __dump_stack lib/dump_stack.c:94 [inline]\n    dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n    print_address_description mm/kasan/report.c:378 [inline]\n    print_report+0x169/0x550 mm/kasan/report.c:489\n    kasan_report+0x143/0x180 mm/kasan/report.c:602\n    join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278\n    start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697\n    flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803\n    btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321\n    process_one_work kernel/workqueue.c:3236 [inline]\n    process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317\n    worker_thread+0x870/0xd30 kernel/workqueue.c:3398\n    kthread+0x2f0/0x390 kernel/kthread.c:389\n    ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n    \u003c/TASK\u003e\n\n   Allocated by task 5315:\n    kasan_save_stack mm/kasan/common.c:47 [inline]\n    kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n    poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n    __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n    kasan_kmalloc include/linux/kasan.h:260 [inline]\n    __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329\n    kmalloc_noprof include/linux/slab.h:901 [inline]\n    join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308\n    start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697\n    btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572\n    lookup_open fs/namei.c:3649 [inline]\n    open_last_lookups fs/namei.c:3748 [inline]\n    path_openat+0x1c03/0x3590 fs/namei.c:3984\n    do_filp_open+0x27f/0x4e0 fs/namei.c:4014\n    do_sys_openat2+0x13e/0x1d0 fs/open.c:1402\n    do_sys_open fs/open.c:1417 [inline]\n    __do_sys_creat fs/open.c:1495 [inline]\n    __se_sys_creat fs/open.c:1489 [inline]\n    __x64_sys_creat+0x123/0x170 fs/open.c:1489\n    do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n    do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n   Freed by task 5336:\n    kasan_save_stack mm/kasan/common.c:47 [inline]\n    kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n    kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n    poison_slab_object mm/kasan/common.c:247 [inline]\n    __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n    kasan_slab_free include/linux/kasan.h:233 [inline]\n    slab_free_hook mm/slub.c:2353 [inline]\n    slab_free mm/slub.c:4613 [inline]\n    kfree+0x196/0x430 mm/slub.c:4761\n    cleanup_transaction fs/btrfs/transaction.c:2063 [inline]\n    btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598\n    insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757\n    btrfs_balance+0x992/\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is btrfs\u0027s transaction layer, reached through ordinary filesystem syscalls (creat/write/unlink/rename/fsync) on a mounted btrfs volume. This requires local system access, not network or physical access.\nAC:L - The attacker controls both sides of the race \u2014 one thread triggers the transaction abort and its cleanup/kfree, while other threads continuously call join_transaction via file operations \u2014 and can retry indefinitely. The window is further widened because __btrfs_abort_transaction sets transaction-\u003eaborted and then emits a WARN stack dump and printk before setting fs_info-\u003efs_error (the gate that would short-circuit join_transaction), and in the -EROFS/read-only case fs_error is never set at all.\nPR:L - Any unprivileged local user with write access to a btrfs filesystem can reach both sides: 53 btrfs_abort_transaction() call sites in fs/btrfs/inode.c alone fire on unprivileged create/unlink/rename/truncate paths (name hash collisions, ENOSPC, item overflow), and join_transaction is hit by every file operation. No capability, ioctl privilege, or namespace trickery is needed.\nUI:N - btrfs is the default root filesystem on Fedora, openSUSE, Synology NAS and many Android devices, so the volume is already mounted and the attacker needs no victim to mount an image or open a file. The entire sequence runs from the attacker\u0027s own threads.\nS:U - The use-after-free corrupts kernel heap state within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The 4-byte read of freed kmalloc-2k memory is propagated out of start_transaction() as the syscall error code, directly leaking heap contents to userspace, and the resulting wild ERR_PTR / refcount-imbalanced transaction join gives an attacker who sprays the freed slab a path to arbitrary kernel reads.\nI:H - A groomed value below -MAX_ERRNO defeats IS_ERR(), so callers dereference an attacker-influenced 0xffffffffxxxxxxxx pointer as a struct btrfs_trans_handle and write through it into the kernel text/module region; a non-negative value instead joins a transaction without incrementing use_count/num_writers, yielding a refcount underflow and a full write-capable UAF.\nA:H - This is a KASAN-confirmed slab use-after-free; a non-negative stale value sends start_transaction into cur_trans-\u003etransid with fs_info-\u003erunning_transaction already NULLed, producing an immediate NULL pointer dereference and kernel oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:08.805Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cee55b1219568c80bf0d5dc55066e4a859baf753"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7a53757717e68af94a56929d57f1e6daff220ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e954b6bb95d67ae4d1a20e9cfd83c182cf929bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ba4663ada6c6315af23a6669d386146634808ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f5cff471039caa2b088060c074c2bf2081bcb01"
        },
        {
          "url": "https://git.kernel.org/stable/c/86d71a026a7f63da905db9add845c8ee88801eca"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce628048390dad80320d5a1f74de6ca1e1be91e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2f0943cf37305dbdeaf9846e3c941451bcdef63"
        }
      ],
      "title": "btrfs: fix use-after-free when attempting to join an aborted transaction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21753",
    "datePublished": "2025-02-27T02:12:23.235Z",
    "dateReserved": "2024-12-29T08:45:45.760Z",
    "dateUpdated": "2026-08-05T11:54:08.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21756 (GCVE-0-2025-21756)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-08-05 11:54

Title

vsock: Keep the binding until socket destruction

Summary

In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect(). Prevents socket unbinding during a transport reassignment, which fixes a use-after-free: 1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2) 2. transport->release() calls vsock_remove_bound() without checking if sk was bound and moved to bound list (refcnt=1) 3. vsock_bind() assumes sk is in unbound list and before __vsock_insert_bound(vsock_bound_sockets()) calls __vsock_remove_bound() which does: list_del_init(&vsk->bound_table); // nop sock_put(&vsk->sk); // refcnt=0 BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730 Read of size 4 at addr ffff88816b46a74c by task a.out/2057 dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 __vsock_bind+0x62e/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 2057: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 __vsock_create.constprop.0+0x2e/0xb60 vsock_create+0xe4/0x420 __sock_create+0x241/0x650 __sys_socket+0xf2/0x1a0 __x64_sys_socket+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 2057: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 __vsock_bind+0x5e1/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e refcount_t: addition on 0; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 RIP: 0010:refcount_warn_saturate+0xce/0x150 __vsock_bind+0x66d/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e refcount_t: underflow; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 RIP: 0010:refcount_warn_saturate+0xee/0x150 vsock_remove_bound+0x187/0x1e0 __vsock_release+0x383/0x4a0 vsock_release+0x90/0x120 __sock_release+0xa3/0x250 sock_close+0x14/0x20 __fput+0x359/0xa80 task_work_run+0x107/0x1d0 do_exit+0x847/0x2560 do_group_exit+0xb8/0x250 __x64_sys_exit_group+0x3a/0x50 x64_sys_call+0xfec/0x14f0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-14 21:01 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/e7754d564579a5db9…
https://git.kernel.org/stable/c/e48fcb403c2d0e574…
https://git.kernel.org/stable/c/42b33381e5e1f2b96…
https://git.kernel.org/stable/c/3f43540166128951c…
https://git.kernel.org/stable/c/645ce25aa0e67895b…
https://git.kernel.org/stable/c/b1afd40321f1c243c…
https://git.kernel.org/stable/c/fcdd2242c0231032f…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Linux	Linux	Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < e7754d564579a5db9c5c9f74228df5d6dd6f1173 (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < e48fcb403c2d0e574c19683f09399ab4cf67809c (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < 42b33381e5e1f2b967dc4fb4221ddb9aaf10d197 (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < 3f43540166128951cc1be7ab1ce6b7f05c670d8b (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < 645ce25aa0e67895b11d89f27bb86c9d444c40f8 (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < b1afd40321f1c243cffbcf40ea7ca41aca87fa5e (git) Affected: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a , < fcdd2242c0231032fc84e1404315c245ae56322a (git)
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.131 , ≤ 6.1.* (semver) Unaffected: 6.6.79 , ≤ 6.6.* (semver) Unaffected: 6.12.16 , ≤ 6.12.* (semver) Unaffected: 6.13.4 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21756",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-14T21:01:56.187542Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-14T21:02:02.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:37:01.186Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:39:57.826Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/af_vsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7754d564579a5db9c5c9f74228df5d6dd6f1173",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "e48fcb403c2d0e574c19683f09399ab4cf67809c",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "42b33381e5e1f2b967dc4fb4221ddb9aaf10d197",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "3f43540166128951cc1be7ab1ce6b7f05c670d8b",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "645ce25aa0e67895b11d89f27bb86c9d444c40f8",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "b1afd40321f1c243cffbcf40ea7ca41aca87fa5e",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "fcdd2242c0231032fc84e1404315c245ae56322a",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/af_vsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.131",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Keep the binding until socket destruction\n\nPreserve sockets bindings; this includes both resulting from an explicit\nbind() and those implicitly bound through autobind during connect().\n\nPrevents socket unbinding during a transport reassignment, which fixes a\nuse-after-free:\n\n    1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)\n    2. transport-\u003erelease() calls vsock_remove_bound() without checking if\n       sk was bound and moved to bound list (refcnt=1)\n    3. vsock_bind() assumes sk is in unbound list and before\n       __vsock_insert_bound(vsock_bound_sockets()) calls\n       __vsock_remove_bound() which does:\n           list_del_init(\u0026vsk-\u003ebound_table); // nop\n           sock_put(\u0026vsk-\u003esk);               // refcnt=0\n\nBUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730\nRead of size 4 at addr ffff88816b46a74c by task a.out/2057\n dump_stack_lvl+0x68/0x90\n print_report+0x174/0x4f6\n kasan_report+0xb9/0x190\n __vsock_bind+0x62e/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nAllocated by task 2057:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n __kasan_slab_alloc+0x85/0x90\n kmem_cache_alloc_noprof+0x131/0x450\n sk_prot_alloc+0x5b/0x220\n sk_alloc+0x2c/0x870\n __vsock_create.constprop.0+0x2e/0xb60\n vsock_create+0xe4/0x420\n __sock_create+0x241/0x650\n __sys_socket+0xf2/0x1a0\n __x64_sys_socket+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 2057:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x37/0x60\n __kasan_slab_free+0x4b/0x70\n kmem_cache_free+0x1a1/0x590\n __sk_destruct+0x388/0x5a0\n __vsock_bind+0x5e1/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150\nRIP: 0010:refcount_warn_saturate+0xce/0x150\n __vsock_bind+0x66d/0x730\n vsock_bind+0x97/0xe0\n __sys_bind+0x154/0x1f0\n __x64_sys_bind+0x6e/0xb0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150\nRIP: 0010:refcount_warn_saturate+0xee/0x150\n vsock_remove_bound+0x187/0x1e0\n __vsock_release+0x383/0x4a0\n vsock_release+0x90/0x120\n __sock_release+0xa3/0x250\n sock_close+0x14/0x20\n __fput+0x359/0xa80\n task_work_run+0x107/0x1d0\n do_exit+0x847/0x2560\n do_group_exit+0xb8/0x250\n __x64_sys_exit_group+0x3a/0x50\n x64_sys_call+0xfec/0x14f0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "Deterministic UAF in vsock socket binding during transport reassignment. connect() unbinds the socket dropping refcount, then bind() triggers use-after-free exploitable for privilege escalation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:09.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7754d564579a5db9c5c9f74228df5d6dd6f1173"
        },
        {
          "url": "https://git.kernel.org/stable/c/e48fcb403c2d0e574c19683f09399ab4cf67809c"
        },
        {
          "url": "https://git.kernel.org/stable/c/42b33381e5e1f2b967dc4fb4221ddb9aaf10d197"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f43540166128951cc1be7ab1ce6b7f05c670d8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/645ce25aa0e67895b11d89f27bb86c9d444c40f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1afd40321f1c243cffbcf40ea7ca41aca87fa5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcdd2242c0231032fc84e1404315c245ae56322a"
        }
      ],
      "title": "vsock: Keep the binding until socket destruction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21756",
    "datePublished": "2025-02-27T02:18:11.547Z",
    "dateReserved": "2024-12-29T08:45:45.760Z",
    "dateUpdated": "2026-08-05T11:54:09.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21760 (GCVE-0-2025-21760)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-09-08 08:40

Title

ndisc: extend RCU protection in ndisc_send_skb()

Summary

In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-27 17:57 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/10a1f3fece2f0d23a…
https://git.kernel.org/stable/c/4d576202b90b1b95a…
https://git.kernel.org/stable/c/e24d225e4cb8cf108…
https://git.kernel.org/stable/c/a9319d800b5701e7f…
https://git.kernel.org/stable/c/ae38982f521621c21…
https://git.kernel.org/stable/c/789230e5a8c109730…
https://git.kernel.org/stable/c/04e05112f10354ffc…
https://git.kernel.org/stable/c/ed6ae1f325d3c4396…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Linux	Linux	Affected: 1762f7e88eb34f653b4a915be99a102e347dd45e , < 10a1f3fece2f0d23a3a618b72b2b4e6f408ef7d1 (git) Affected: 1762f7e88eb34f653b4a915be99a102e347dd45e , < 4d576202b90b1b95a7c428a80b536f91b8201bcc (git) Affected: 1762f7e88eb34f653b4a915be99a102e347dd45e , < e24d225e4cb8cf108bde00b76594499b98f0a74d (git) Affected: 1762f7e88eb34f653b4a915be99a102e347dd45e , < a9319d800b5701e7f5e3fa71a5b7c4831fc20d6d (git) Affected: 1762f7e88eb34f653b4a915be99a102e347dd45e , < ae38982f521621c216fc2f5182cd091f4734641d (git) Affected: 1762f7e88eb34f653b4a915be99a102e347dd45e , < 789230e5a8c1097301afc802e242c79bc8835c67 (git) Affected: 1762f7e88eb34f653b4a915be99a102e347dd45e , < 04e05112f10354ffc3bb6cc796d553bab161594c (git) Affected: 1762f7e88eb34f653b4a915be99a102e347dd45e , < ed6ae1f325d3c43966ec1b62ac1459e2b8e45640 (git)
Linux	Linux	Affected: 2.6.26 Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.79 , ≤ 6.6.* (semver) Unaffected: 6.12.16 , ≤ 6.12.* (semver) Unaffected: 6.13.4 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21760",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:57:40.416234Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:27.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:37:05.973Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:40:31.196Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ndisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10a1f3fece2f0d23a3a618b72b2b4e6f408ef7d1",
              "status": "affected",
              "version": "1762f7e88eb34f653b4a915be99a102e347dd45e",
              "versionType": "git"
            },
            {
              "lessThan": "4d576202b90b1b95a7c428a80b536f91b8201bcc",
              "status": "affected",
              "version": "1762f7e88eb34f653b4a915be99a102e347dd45e",
              "versionType": "git"
            },
            {
              "lessThan": "e24d225e4cb8cf108bde00b76594499b98f0a74d",
              "status": "affected",
              "version": "1762f7e88eb34f653b4a915be99a102e347dd45e",
              "versionType": "git"
            },
            {
              "lessThan": "a9319d800b5701e7f5e3fa71a5b7c4831fc20d6d",
              "status": "affected",
              "version": "1762f7e88eb34f653b4a915be99a102e347dd45e",
              "versionType": "git"
            },
            {
              "lessThan": "ae38982f521621c216fc2f5182cd091f4734641d",
              "status": "affected",
              "version": "1762f7e88eb34f653b4a915be99a102e347dd45e",
              "versionType": "git"
            },
            {
              "lessThan": "789230e5a8c1097301afc802e242c79bc8835c67",
              "status": "affected",
              "version": "1762f7e88eb34f653b4a915be99a102e347dd45e",
              "versionType": "git"
            },
            {
              "lessThan": "04e05112f10354ffc3bb6cc796d553bab161594c",
              "status": "affected",
              "version": "1762f7e88eb34f653b4a915be99a102e347dd45e",
              "versionType": "git"
            },
            {
              "lessThan": "ed6ae1f325d3c43966ec1b62ac1459e2b8e45640",
              "status": "affected",
              "version": "1762f7e88eb34f653b4a915be99a102e347dd45e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ndisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nndisc: extend RCU protection in ndisc_send_skb()\n\nndisc_send_skb() can be called without RTNL or RCU held.\n\nAcquire rcu_read_lock() earlier, so that we can use dev_net_rcu()\nand avoid a potential UAF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - `ndisc_send_skb()` sits on the IPv6 neighbour-discovery transmit path, which is driven by ordinary received network traffic \u2014 a remote packet that requires a next-hop resolve causes `neigh_probe()`\u2192`ndisc_solicit()`\u2192`ndisc_send_ns()`\u2192`ndisc_send_skb( )`, and inbound NS/RS/forwarded packets also reach it via `ndisc_send_na()`/`ndisc_send_redirect()`. This matches the AV:N assessment of its direct IPv4 counterpart `arp_xmit()` in the same series.\nAC:H - The stale `struct net` only becomes a use-after-free if the device\u0027s netns is concurrently dismantled (`dev_change_net_namespace()` from `default_device_exit_batch()` followed by `net_free()`), and a remote attacker can neither trigger nor time netns teardown. Hitting the window therefore depends on host-side container/netns churn outside the attacker\u0027s control.\nPR:N - The ND transmit path is entered from unauthenticated received packets and from routing-driven neighbour probing; no credentials, account, or capability on the target host are needed to drive it.\nUI:N - Neighbour solicitation, router probing and NA replies are automatic kernel behaviours triggered by packet arrival and timer/workqueue expiry; no victim action is involved.\nS:U - The freed `struct net`, its `ndisc_sk`, MIB counters and netfilter hook arrays all live in the kernel\u0027s own security authority, so impact stays within the kernel \u2014 no VM, IOMMU or sandbox boundary is crossed.\nC:H - `sk` is loaded from the freed `net`, and `READ_ONCE(inet6_sk(sk)-\u003ehop_limit)` is copied into a transmitted ICMPv6 header, so a reclaimed-slab spray yields a read of attacker-chosen kernel memory exfiltrated onto the wire; more generally a UAF of `struct net` gives an arbitrary-read primitive.\nI:H - `IP6_INC_STATS`/`ICMP6_INC_STATS` increment through a per-cpu pointer read from freed memory, and `NF_HOOK()` dispatches indirect calls through `net-\u003enf.hooks_ipv6[]` loaded from the freed object, giving both a write primitive and a plausible control-flow-hijack path.\nA:H - Dereferencing a freed `struct net` and the garbage `ndisc_sk` pointer derived from it reliably produces an oops or panic, and the corrupted netfilter hook walk can take the whole kernel down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:13.122Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10a1f3fece2f0d23a3a618b72b2b4e6f408ef7d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d576202b90b1b95a7c428a80b536f91b8201bcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/e24d225e4cb8cf108bde00b76594499b98f0a74d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9319d800b5701e7f5e3fa71a5b7c4831fc20d6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae38982f521621c216fc2f5182cd091f4734641d"
        },
        {
          "url": "https://git.kernel.org/stable/c/789230e5a8c1097301afc802e242c79bc8835c67"
        },
        {
          "url": "https://git.kernel.org/stable/c/04e05112f10354ffc3bb6cc796d553bab161594c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed6ae1f325d3c43966ec1b62ac1459e2b8e45640"
        }
      ],
      "title": "ndisc: extend RCU protection in ndisc_send_skb()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21760",
    "datePublished": "2025-02-27T02:18:13.496Z",
    "dateReserved": "2024-12-29T08:45:45.761Z",
    "dateUpdated": "2026-09-08T08:40:31.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21761 (GCVE-0-2025-21761)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-08-05 11:54

Title

openvswitch: use RCU protection in ovs_vport_cmd_fill_info()

Summary

In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-27 17:57 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/e85a25d1a9985645e…
https://git.kernel.org/stable/c/a8816b3f1f151373f…
https://git.kernel.org/stable/c/a884f57600e463f69…
https://git.kernel.org/stable/c/7e01abc34e87abd09…
https://git.kernel.org/stable/c/8ec57509c36c8b9a2…
https://git.kernel.org/stable/c/a849a10de5e04d798…
https://git.kernel.org/stable/c/5828937742af74666…
https://git.kernel.org/stable/c/90b2f49a502fa7109…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 9354d452034273a50a4fd703bea31e5d6b1fc20b , < e85a25d1a9985645e796039e843d1de581d2de1e (git) Affected: 9354d452034273a50a4fd703bea31e5d6b1fc20b , < a8816b3f1f151373fd30f1996f00480126c8bb11 (git) Affected: 9354d452034273a50a4fd703bea31e5d6b1fc20b , < a884f57600e463f69d7b279c4598b865260b62a1 (git) Affected: 9354d452034273a50a4fd703bea31e5d6b1fc20b , < 7e01abc34e87abd091e619161a20f54ed4e3e2da (git) Affected: 9354d452034273a50a4fd703bea31e5d6b1fc20b , < 8ec57509c36c8b9a23e50b7858dda0c520a2d074 (git) Affected: 9354d452034273a50a4fd703bea31e5d6b1fc20b , < a849a10de5e04d798f7f286a2f1ca174719a617a (git) Affected: 9354d452034273a50a4fd703bea31e5d6b1fc20b , < 5828937742af74666192835d657095d95c53dbd0 (git) Affected: 9354d452034273a50a4fd703bea31e5d6b1fc20b , < 90b2f49a502fa71090d9f4fe29a2f51fe5dff76d (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.79 , ≤ 6.6.* (semver) Unaffected: 6.12.16 , ≤ 6.12.* (semver) Unaffected: 6.13.4 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21761",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:57:35.920303Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:27.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:37:08.745Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:03:41.909Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/datapath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e85a25d1a9985645e796039e843d1de581d2de1e",
              "status": "affected",
              "version": "9354d452034273a50a4fd703bea31e5d6b1fc20b",
              "versionType": "git"
            },
            {
              "lessThan": "a8816b3f1f151373fd30f1996f00480126c8bb11",
              "status": "affected",
              "version": "9354d452034273a50a4fd703bea31e5d6b1fc20b",
              "versionType": "git"
            },
            {
              "lessThan": "a884f57600e463f69d7b279c4598b865260b62a1",
              "status": "affected",
              "version": "9354d452034273a50a4fd703bea31e5d6b1fc20b",
              "versionType": "git"
            },
            {
              "lessThan": "7e01abc34e87abd091e619161a20f54ed4e3e2da",
              "status": "affected",
              "version": "9354d452034273a50a4fd703bea31e5d6b1fc20b",
              "versionType": "git"
            },
            {
              "lessThan": "8ec57509c36c8b9a23e50b7858dda0c520a2d074",
              "status": "affected",
              "version": "9354d452034273a50a4fd703bea31e5d6b1fc20b",
              "versionType": "git"
            },
            {
              "lessThan": "a849a10de5e04d798f7f286a2f1ca174719a617a",
              "status": "affected",
              "version": "9354d452034273a50a4fd703bea31e5d6b1fc20b",
              "versionType": "git"
            },
            {
              "lessThan": "5828937742af74666192835d657095d95c53dbd0",
              "status": "affected",
              "version": "9354d452034273a50a4fd703bea31e5d6b1fc20b",
              "versionType": "git"
            },
            {
              "lessThan": "90b2f49a502fa71090d9f4fe29a2f51fe5dff76d",
              "status": "affected",
              "version": "9354d452034273a50a4fd703bea31e5d6b1fc20b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/datapath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: use RCU protection in ovs_vport_cmd_fill_info()\n\novs_vport_cmd_fill_info() can be called without RTNL or RCU.\n\nUse RCU protection and dev_net_rcu() to avoid potential UAF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the openvswitch generic-netlink family (OVS_VPORT_CMD_NEW/SET/DEL) and through netdev namespace migration triggered by local syscalls; there is no remote or adjacent-network input path.\nAC:L - The attacker controls both sides of the race \u2014 it schedules the netns teardown (dropping the last reference to a namespace it created) and the `ovs_dp_notify_wq`/vport command that re-reads `dev_net(vport-\u003edev)` \u2014 and can repeat the sequence indefinitely until the window is hit.\nPR:L - The vport commands use GENL_UNS_ADMIN_PERM, i.e. `netlink_ns_capable(skb, net-\u003euser_ns, CAP_NET_ADMIN)`, which any unprivileged user obtains via `unshare -Urn`; namespace creation and `ip link set ... netns` likewise need only namespaced capabilities, and the module auto-loads on family lookup.\nUI:N - The entire sequence \u2014 datapath creation, port attach, namespace move and teardown \u2014 is performed by the attacker\u0027s own processes with no action from any other user.\nS:U - The corruption and its consequences stay within the kernel\u0027s own security authority; no hypervisor, IOMMU, or other trust boundary is crossed.\nC:H - Use-after-free read of a freed `struct net`, plus `alloc_netid()` persists the dangling pointer into a live namespace\u0027s `netns_ids` IDR where the attacker can resurrect it via RTM_GETNSID/IFLA_TARGET_NETNSID/BPF `get_net_ns_by_id()`, yielding access to reallocated kernel memory and cross-namespace state.\nI:H - `maybe_get_net()` and `put_net()` perform atomic refcount increments/decrements directly on freed slab memory, corrupting whatever object reuses it, and a stale `struct net *` is durably written into a live namespace\u0027s IDR \u2014 a standard UAF write primitive leveragable for privilege escalation.\nA:H - Dereferencing and refcount-manipulating a freed `struct net` causes oops/panic, and a spurious `put_net()` can drive `__put_net()`/`cleanup_net()` over a destroyed or reused object, crashing the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:14.184Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e85a25d1a9985645e796039e843d1de581d2de1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8816b3f1f151373fd30f1996f00480126c8bb11"
        },
        {
          "url": "https://git.kernel.org/stable/c/a884f57600e463f69d7b279c4598b865260b62a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e01abc34e87abd091e619161a20f54ed4e3e2da"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ec57509c36c8b9a23e50b7858dda0c520a2d074"
        },
        {
          "url": "https://git.kernel.org/stable/c/a849a10de5e04d798f7f286a2f1ca174719a617a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5828937742af74666192835d657095d95c53dbd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/90b2f49a502fa71090d9f4fe29a2f51fe5dff76d"
        }
      ],
      "title": "openvswitch: use RCU protection in ovs_vport_cmd_fill_info()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21761",
    "datePublished": "2025-02-27T02:18:14.054Z",
    "dateReserved": "2024-12-29T08:45:45.761Z",
    "dateUpdated": "2026-08-05T11:54:14.184Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21762 (GCVE-0-2025-21762)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-08-05 11:54

Title

arp: use RCU protection in arp_xmit()

Summary

In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-27 17:57 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/10f555e3f573d004a…
https://git.kernel.org/stable/c/307cd1e2d3cb1cbc6…
https://git.kernel.org/stable/c/d9366ac2f956a1948…
https://git.kernel.org/stable/c/f189654459423d4d4…
https://git.kernel.org/stable/c/e9f4dee534eb1b225…
https://git.kernel.org/stable/c/01d1b5c9abcaff29a…
https://git.kernel.org/stable/c/2c331718d3389b6c5…
https://git.kernel.org/stable/c/a42b69f692165ec39…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

4 products

Vendor	Product	Version
Linux	Linux	Affected: 29a26a56803855a79dbd028cd61abee56237d6e5 , < 10f555e3f573d004ae9d89b3276abb58c4ede5c3 (git) Affected: 29a26a56803855a79dbd028cd61abee56237d6e5 , < 307cd1e2d3cb1cbc6c40c679cada6d7168b18431 (git) Affected: 29a26a56803855a79dbd028cd61abee56237d6e5 , < d9366ac2f956a1948b68c0500f84a3462ff2ed8a (git) Affected: 29a26a56803855a79dbd028cd61abee56237d6e5 , < f189654459423d4d48bef2d120b4bfba559e6039 (git) Affected: 29a26a56803855a79dbd028cd61abee56237d6e5 , < e9f4dee534eb1b225b0a120395ad9bc2afe164d3 (git) Affected: 29a26a56803855a79dbd028cd61abee56237d6e5 , < 01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe (git) Affected: 29a26a56803855a79dbd028cd61abee56237d6e5 , < 2c331718d3389b6c5f6855078ab7171849e016bd (git) Affected: 29a26a56803855a79dbd028cd61abee56237d6e5 , < a42b69f692165ec39db42d595f4f65a4c8f42e44 (git)
Linux	Linux	Affected: 4.4 Unaffected: 0 , < 4.4 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.79 , ≤ 6.6.* (semver) Unaffected: 6.12.16 , ≤ 6.12.* (semver) Unaffected: 6.13.4 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - BIOS	Affected: 0 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:57:30.024595Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:27.083Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:37:11.540Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - BIOS",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:03:43.118Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-503939.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/arp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10f555e3f573d004ae9d89b3276abb58c4ede5c3",
              "status": "affected",
              "version": "29a26a56803855a79dbd028cd61abee56237d6e5",
              "versionType": "git"
            },
            {
              "lessThan": "307cd1e2d3cb1cbc6c40c679cada6d7168b18431",
              "status": "affected",
              "version": "29a26a56803855a79dbd028cd61abee56237d6e5",
              "versionType": "git"
            },
            {
              "lessThan": "d9366ac2f956a1948b68c0500f84a3462ff2ed8a",
              "status": "affected",
              "version": "29a26a56803855a79dbd028cd61abee56237d6e5",
              "versionType": "git"
            },
            {
              "lessThan": "f189654459423d4d48bef2d120b4bfba559e6039",
              "status": "affected",
              "version": "29a26a56803855a79dbd028cd61abee56237d6e5",
              "versionType": "git"
            },
            {
              "lessThan": "e9f4dee534eb1b225b0a120395ad9bc2afe164d3",
              "status": "affected",
              "version": "29a26a56803855a79dbd028cd61abee56237d6e5",
              "versionType": "git"
            },
            {
              "lessThan": "01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe",
              "status": "affected",
              "version": "29a26a56803855a79dbd028cd61abee56237d6e5",
              "versionType": "git"
            },
            {
              "lessThan": "2c331718d3389b6c5f6855078ab7171849e016bd",
              "status": "affected",
              "version": "29a26a56803855a79dbd028cd61abee56237d6e5",
              "versionType": "git"
            },
            {
              "lessThan": "a42b69f692165ec39db42d595f4f65a4c8f42e44",
              "status": "affected",
              "version": "29a26a56803855a79dbd028cd61abee56237d6e5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/arp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narp: use RCU protection in arp_xmit()\n\narp_xmit() can be called without RTNL or RCU protection.\n\nUse RCU protection to avoid potential UAF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The unprotected `arp_xmit()` calls are driven by the neighbour-resolution path (`neigh_timer_handler` \u2192 `neigh_probe` \u2192 `arp_solicit`), which a remote off-link attacker triggers at will by sending traffic to a Linux router/gateway that must resolve on-link next hops, as well as by ARP frames processed in `arp_process()`/bridge neigh-suppression. The vulnerable code is bound to the network stack and reachable from remotely originated packets, so Network is the correct and higher-severity classification.\nAC:H - The attacker fully controls and can sustain the ARP-transmit side of the race, but the other side \u2014 a `struct net` being freed via `cleanup_net()` or a device migrating namespaces \u2014 is background system activity the network attacker cannot command. Because that condition lies outside attacker control, complexity is High.\nPR:N - There is no capability check, credential check, or authentication gate anywhere on the path from packet receipt/neighbour resolution to `arp_xmit()`; ARP solicitation and reply generation happen unconditionally in softirq context. An entirely unauthenticated attacker reaches the vulnerable code.\nUI:N - The attacker\u0027s own packets cause the kernel to emit ARP and execute the vulnerable code; no victim must mount a filesystem, open a file, or take any other action.\nS:U - The use-after-free of `struct net` and the resulting corruption stay entirely within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A use-after-free of `struct net` lets `nf_hook()` read `net-\u003enf.hooks_arp[]` and every ARP-family hook read `state-\u003enet` out of freed, potentially reallocated slab memory. Per kernel guidance a UAF gives the attacker control over the freed object\u0027s contents and thus an arbitrary kernel-memory read primitive.\nI:H - The stale `net` yields a `hook_head` pointer from freed memory, and `nf_hook_slow()` then performs an indirect call through `e-\u003ehooks[s].hook` \u2014 a direct function-pointer hijack primitive if the netns slab is reallocated with sprayed data. Hooks also write through `state-\u003enet`, corrupting reused kernel objects.\nA:H - Dereferencing a freed `struct net` and calling through a garbage `nf_hook_entries` reliably oopses or panics the kernel, and is a KASAN-reportable memory-safety violation that panics on hardened configurations. Any such kernel crash is scored High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:15.248Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10f555e3f573d004ae9d89b3276abb58c4ede5c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/307cd1e2d3cb1cbc6c40c679cada6d7168b18431"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9366ac2f956a1948b68c0500f84a3462ff2ed8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f189654459423d4d48bef2d120b4bfba559e6039"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9f4dee534eb1b225b0a120395ad9bc2afe164d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c331718d3389b6c5f6855078ab7171849e016bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/a42b69f692165ec39db42d595f4f65a4c8f42e44"
        }
      ],
      "title": "arp: use RCU protection in arp_xmit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21762",
    "datePublished": "2025-02-27T02:18:14.600Z",
    "dateReserved": "2024-12-29T08:45:45.761Z",
    "dateUpdated": "2026-08-05T11:54:15.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21763 (GCVE-0-2025-21763)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-08-05 11:54

Title

neighbour: use RCU protection in __neigh_notify()

Summary

In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-27 17:57 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/e1aed6be381bcd7f4…
https://git.kernel.org/stable/c/8666e9aab801328c1…
https://git.kernel.org/stable/c/40d8f2f2a373b6c29…
https://git.kernel.org/stable/c/784eb2376270e086f…
https://git.kernel.org/stable/c/1cbb2aa90cd3fba15…
https://git.kernel.org/stable/c/cdd5c2a12ddad8a77…
https://git.kernel.org/stable/c/559307d25235e24b5…
https://git.kernel.org/stable/c/becbd5850c03ed33b…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 426b5303eb435d98b9bee37a807be386bc2b3320 , < e1aed6be381bcd7f46d4ca9d7ef0f5f3d6a1be32 (git) Affected: 426b5303eb435d98b9bee37a807be386bc2b3320 , < 8666e9aab801328c1408a19fbf4070609dc0695a (git) Affected: 426b5303eb435d98b9bee37a807be386bc2b3320 , < 40d8f2f2a373b6c294ffac394d2bb814b572ead1 (git) Affected: 426b5303eb435d98b9bee37a807be386bc2b3320 , < 784eb2376270e086f7db136d154b8404edacf97b (git) Affected: 426b5303eb435d98b9bee37a807be386bc2b3320 , < 1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379 (git) Affected: 426b5303eb435d98b9bee37a807be386bc2b3320 , < cdd5c2a12ddad8a77ce1838ff9f29aa587de82df (git) Affected: 426b5303eb435d98b9bee37a807be386bc2b3320 , < 559307d25235e24b5424778c7332451b6c741159 (git) Affected: 426b5303eb435d98b9bee37a807be386bc2b3320 , < becbd5850c03ed33b232083dd66c6e38c0c0e569 (git)
Linux	Linux	Affected: 2.6.25 Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.79 , ≤ 6.6.* (semver) Unaffected: 6.12.16 , ≤ 6.12.* (semver) Unaffected: 6.13.4 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21763",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:57:24.552153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:26.961Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:37:14.329Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:03:44.302Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/neighbour.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e1aed6be381bcd7f46d4ca9d7ef0f5f3d6a1be32",
              "status": "affected",
              "version": "426b5303eb435d98b9bee37a807be386bc2b3320",
              "versionType": "git"
            },
            {
              "lessThan": "8666e9aab801328c1408a19fbf4070609dc0695a",
              "status": "affected",
              "version": "426b5303eb435d98b9bee37a807be386bc2b3320",
              "versionType": "git"
            },
            {
              "lessThan": "40d8f2f2a373b6c294ffac394d2bb814b572ead1",
              "status": "affected",
              "version": "426b5303eb435d98b9bee37a807be386bc2b3320",
              "versionType": "git"
            },
            {
              "lessThan": "784eb2376270e086f7db136d154b8404edacf97b",
              "status": "affected",
              "version": "426b5303eb435d98b9bee37a807be386bc2b3320",
              "versionType": "git"
            },
            {
              "lessThan": "1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379",
              "status": "affected",
              "version": "426b5303eb435d98b9bee37a807be386bc2b3320",
              "versionType": "git"
            },
            {
              "lessThan": "cdd5c2a12ddad8a77ce1838ff9f29aa587de82df",
              "status": "affected",
              "version": "426b5303eb435d98b9bee37a807be386bc2b3320",
              "versionType": "git"
            },
            {
              "lessThan": "559307d25235e24b5424778c7332451b6c741159",
              "status": "affected",
              "version": "426b5303eb435d98b9bee37a807be386bc2b3320",
              "versionType": "git"
            },
            {
              "lessThan": "becbd5850c03ed33b232083dd66c6e38c0c0e569",
              "status": "affected",
              "version": "426b5303eb435d98b9bee37a807be386bc2b3320",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/neighbour.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nneighbour: use RCU protection in __neigh_notify()\n\n__neigh_notify() can be called without RTNL or RCU protection.\n\nUse RCU protection to avoid potential UAF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The decisive side of the race \u2014 `dev_net_set()` during netdevice namespace migration or `default_device_exit_batch()` on netns teardown, followed by freeing the `struct net` \u2014 is driven only by local syscalls (`unshare(CLONE_NEWNET|CLONE_NEWUSER)`, RTM_NEWLINK/RTM_SETLINK). A purely remote or adjacent peer can generate ARP/NDISC traffic to reach `__neigh_notify()` but cannot cause the namespace pointer to go stale.\nAC:L - The attacker controls both sides: they spin a loop creating/destroying network namespaces with veth devices while concurrently driving neighbour add/update/GC notifications on other CPUs, so the race is created rather than waited for. Per race-condition guidance, attacker-created races are Low even though the window between the `dev_net()` load and the `net-\u003ertnl` dereference is narrow.\nPR:L - `unshare -Urn` grants namespace-relative CAP_NET_ADMIN (`ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`), letting an ordinary unprivileged user create netns, create and move veth pairs, and trigger the teardown path; no real root is needed. Neighbour-table activity that reaches `__neigh_notify()` is likewise available to any unprivileged process.\nUI:N - The attacker triggers both the namespace teardown and the neighbour notifications entirely from their own processes. No victim action, mount, or file open is involved.\nS:U - The use-after-free and its consequences are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed. This is standard in-kernel corruption leading to local privilege escalation.\nC:H - The freed `struct net` is a reclaimable `net_cachep` slab object, and `net-\u003ertnl` is subsequently consumed as a `struct sock *` by `netlink_set_err()`/`nlmsg_notify()`, which read `sk-\u003esk_protocol` and `sock_net(sk)` and walk netlink tables from it. Heap-spraying the freed object turns this into an attacker-directed kernel read primitive.\nI:H - With the freed `struct net` reclaimed under attacker control, `netlink_set_err()` writes through the forged `sk` pointer (`sk-\u003esk_err = err`, list/waitqueue manipulation), giving a controlled kernel write usable for control-flow hijacking. Per guidance, use-after-free is scored High for integrity.\nA:H - Even without successful reclaim, dereferencing the freed `struct net` and the dangling `net-\u003ertnl` socket causes a kernel oops or panic in `nlmsg_notify()`/`netlink_set_err()`. The trigger loop can be repeated indefinitely by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:16.348Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e1aed6be381bcd7f46d4ca9d7ef0f5f3d6a1be32"
        },
        {
          "url": "https://git.kernel.org/stable/c/8666e9aab801328c1408a19fbf4070609dc0695a"
        },
        {
          "url": "https://git.kernel.org/stable/c/40d8f2f2a373b6c294ffac394d2bb814b572ead1"
        },
        {
          "url": "https://git.kernel.org/stable/c/784eb2376270e086f7db136d154b8404edacf97b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdd5c2a12ddad8a77ce1838ff9f29aa587de82df"
        },
        {
          "url": "https://git.kernel.org/stable/c/559307d25235e24b5424778c7332451b6c741159"
        },
        {
          "url": "https://git.kernel.org/stable/c/becbd5850c03ed33b232083dd66c6e38c0c0e569"
        }
      ],
      "title": "neighbour: use RCU protection in __neigh_notify()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21763",
    "datePublished": "2025-02-27T02:18:15.078Z",
    "dateReserved": "2024-12-29T08:45:45.761Z",
    "dateUpdated": "2026-08-05T11:54:16.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CERTFR-2025-AVI-0463

Solutions

CVE-2025-21736 (GCVE-0-2025-21736)

CVE-2025-21744 (GCVE-0-2025-21744)

CVE-2025-21745 (GCVE-0-2025-21745)

CVE-2025-21749 (GCVE-0-2025-21749)

CVE-2025-21753 (GCVE-0-2025-21753)

CVE-2025-21756 (GCVE-0-2025-21756)

CVE-2025-21760 (GCVE-0-2025-21760)

CVE-2025-21761 (GCVE-0-2025-21761)

CVE-2025-21762 (GCVE-0-2025-21762)

CVE-2025-21763 (GCVE-0-2025-21763)

Tags

Sightings

Nomenclature