CVE-2025-21763 – This CVE-2025-21763 is a use-after-free vulnera... (How to Fix)

Q: What is the severity of CVE-2025-21763?

CVE-2025-21763 has a CVSS score of 7.8 (HIGH). This CVE-2025-21763 is a use-after-free vulnerability in the Linux kernel's neighbour subsystem, specifically in the __neigh_notify() function. It allows attackers with local access to potentially crash the kernel or execute arbitrary code. All Linux systems using affected kernel versions are vulnerable.

📋 TL;DR

This CVE-2025-21763 is a use-after-free vulnerability in the Linux kernel's neighbour subsystem, specifically in the __neigh_notify() function. It allows attackers with local access to potentially crash the kernel or execute arbitrary code. All Linux systems using affected kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE description; check kernel commit references for exact ranges

Operating Systems: All Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in default kernel configurations when using the neighbour subsystem (ARP/NDISC).

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or privilege escalation allowing full system compromise and arbitrary code execution.

🟠

Likely Case

Kernel crash causing denial of service, potentially requiring system reboot and disrupting services.

🟢

If Mitigated

Minimal impact if proper access controls prevent unauthorized local users from triggering the vulnerability.

🌐 Internet-Facing: LOW - This requires local access to exploit, not directly reachable from internet-facing services.

🏢 Internal Only: MEDIUM - Internal attackers with local access could exploit this to disrupt systems or potentially escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and knowledge of kernel internals; race condition exploitation may be challenging.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the referenced git commits

Vendor Advisory: https://git.kernel.org/stable/c/1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Restrict local user access

all

Limit local user accounts and implement strict access controls to reduce attack surface

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized local users from accessing systems
Monitor for kernel panic/crash events and have incident response procedures ready

🔍 How to Verify

Check if Vulnerable:

Check kernel version against distribution security advisories; examine if kernel includes vulnerable __neigh_notify() implementation

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version matches patched version from distribution; check that kernel includes RCU protection in __neigh_notify()

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
System crash/reboot events
Unexpected neighbour subsystem errors

Network Indicators:

Unusual ARP/neighbour table manipulation attempts

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "neighbour" OR "UAF")

📊 Metadata

CVE ID: CVE-2025-21763

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.04% exploit probability (10.6th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21763, you might also want to check these: