CVE-2025-21761 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2025-21761?

CVE-2025-21761 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's Open vSwitch module. The ovs_vport_cmd_fill_info() function can be called without proper RCU protection, potentially allowing local attackers to cause memory corruption. Systems running vulnerable Linux kernel versions with Open vSwitch enabled are affected.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's Open vSwitch module. The ovs_vport_cmd_fill_info() function can be called without proper RCU protection, potentially allowing local attackers to cause memory corruption. Systems running vulnerable Linux kernel versions with Open vSwitch enabled are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE description; check kernel commit references for exact ranges.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when Open vSwitch module is loaded and in use. Many systems may not have this module enabled by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic leading to denial of service, or arbitrary code execution in kernel context.

🟠

Likely Case

Local denial of service through kernel panic or system crash.

🟢

If Mitigated

Minimal impact if proper access controls restrict local user privileges and Open vSwitch is not in use.

🌐 Internet-Facing: LOW - This requires local access to exploit.

🏢 Internal Only: MEDIUM - Internal users with shell access could potentially exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and knowledge of kernel exploitation techniques. No public exploit code is known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check kernel commit hashes provided in references for specific patched versions

Vendor Advisory: https://git.kernel.org/stable/c/5828937742af74666192835d657095d95c53dbd0

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify Open vSwitch module loads correctly after reboot.

🔧 Temporary Workarounds

Disable Open vSwitch module

Linux

Unload the Open vSwitch kernel module if not required

sudo rmmod openvswitch

Blacklist Open vSwitch module

Linux

Prevent Open vSwitch module from loading at boot

echo 'blacklist openvswitch' | sudo tee /etc/modprobe.d/blacklist-openvswitch.conf

🧯 If You Can't Patch

Restrict local user access to systems running Open vSwitch
Implement strict privilege separation and limit shell access to trusted users only

🔍 How to Verify

Check if Vulnerable:

Check if Open vSwitch module is loaded: lsmod | grep openvswitch. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to patched version and Open vSwitch module loads without errors.

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crash/panic logs
Open vSwitch module loading errors

Network Indicators:

None - this is a local vulnerability

SIEM Query:

Search for kernel panic events or Open vSwitch related crashes in system logs

📊 Metadata

CVE ID: CVE-2025-21761

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.04% exploit probability (12.3th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21761, you might also want to check these: