Login Sign Up

CVE-2025-21765

5.5 MEDIUM

📋 TL;DR

A race condition vulnerability in the Linux kernel's IPv6 implementation where ip6_default_advmss() function accesses network structure without proper RCU (Read-Copy-Update) protection. This could allow a local attacker to cause a kernel crash or potentially execute arbitrary code. Affects Linux systems with IPv6 enabled.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Specific affected versions not specified in CVE, but patches exist for multiple stable branches
Operating Systems: Linux distributions using vulnerable kernel versions
Default Config Vulnerable: ⚠️ Yes
Notes: Requires IPv6 to be enabled. Most modern Linux distributions have IPv6 enabled by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation leading to full system compromise or kernel panic causing system crash.

🟠

Likely Case

Kernel panic leading to denial of service (system crash/reboot).

🟢

If Mitigated

Minimal impact with proper kernel hardening and restricted local access.

🌐 Internet-Facing: LOW - Requires local access to exploit.
🏢 Internal Only: MEDIUM - Local attackers on multi-user systems could cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Requires local access and precise timing to trigger race condition. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in kernel commits: 28de355b63ad42309ed5a03ee7c436c90512265b, 3c8ffcd248da34fc41e52a46e51505900115fc2a, 4176a68b0db8fc74ac14fcd00ba8231371051dc2, 550ed693f47370502a71b85382e7f9e6417300b8, 713a40c892f40300d63691d9f85b2a23b48fe1e8

Vendor Advisory: https://git.kernel.org/stable/c/28de355b63ad42309ed5a03ee7c436c90512265b

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. Check with your distribution vendor for specific patched kernel version. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable IPv6

linux

Temporarily disable IPv6 to mitigate the vulnerability

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
echo 1 > /proc/sys/net/ipv6/conf/default/disable_ipv6

🧯 If You Can't Patch

  • Restrict local user access to essential personnel only
  • Implement kernel hardening measures like SELinux/AppArmor to limit impact

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions from kernel git repository

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version contains one of the fix commits: uname -r and check with distribution vendor

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic logs in /var/log/kern.log or dmesg
  • System crash/reboot events

Network Indicators:

  • Unusual local process behavior attempting to manipulate IPv6 settings

SIEM Query:

source="kern.log" AND "kernel panic" OR "Oops"

📊 Metadata

CVE ID: CVE-2025-21765
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score: 0.06% exploit probability (18.6th percentile)
Published: February 27, 2025
Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON