CVE-2025-21762 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2025-21762?

CVE-2025-21762 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's ARP (Address Resolution Protocol) implementation. The arp_xmit() function can be called without proper RCU (Read-Copy-Update) protection, potentially allowing local attackers to cause memory corruption. This affects all Linux systems using vulnerable kernel versions.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's ARP (Address Resolution Protocol) implementation. The arp_xmit() function can be called without proper RCU (Read-Copy-Update) protection, potentially allowing local attackers to cause memory corruption. This affects all Linux systems using vulnerable kernel versions.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions not explicitly stated in CVE description; check kernel commit history for affected versions.

Operating Systems: All Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: All default configurations using ARP networking are vulnerable. Requires local access to trigger.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic leading to denial of service, or arbitrary code execution in kernel context.

🟠

Likely Case

Local denial of service through kernel panic or system crash.

🟢

If Mitigated

Minimal impact with proper kernel hardening and restricted local access.

🌐 Internet-Facing: LOW - This is a local vulnerability requiring access to the system.

🏢 Internal Only: MEDIUM - Malicious local users or compromised accounts could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and knowledge of kernel memory management. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the referenced git commits: 01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe, 10f555e3f573d004ae9d89b3276abb58c4ede5c3, 2c331718d3389b6c5f6855078ab7171849e016bd, 307cd1e2d3cb1cbc6c40c679cada6d7168b18431, a42b69f692165ec39db42d595f4f65a4c8f42e44

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Check your Linux distribution's security advisories. 2. Update kernel package using your package manager (apt, yum, dnf, etc.). 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Restrict local user access

all

Limit local user accounts and implement strict access controls to reduce attack surface.

🧯 If You Can't Patch

Implement strict access controls to limit local user accounts
Enable kernel hardening features like SELinux/AppArmor to limit impact

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution's security advisory. Vulnerable if using unpatched kernel before fixes were applied.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update matches patched version from your distribution's security advisory.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
System crash dumps
Unexpected system reboots

Network Indicators:

Unusual ARP traffic patterns from local processes

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "segfault")

📊 Metadata

CVE ID: CVE-2025-21762

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.04% exploit probability (12.3th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21762, you might also want to check these: