Security readout for executives and security teams
Plain-English summary
A Linux kernel race can leave the ipvlan networking code using a network-device object after it has been freed. A local, low-privileged attacker may be able to trigger memory corruption, potentially affecting confidentiality, integrity, or availability. Exposure depends on vulnerable kernel code and ipvlan-related device activity.
Executive priority
Prioritize exposed multi-user, container, and orchestration hosts using ipvlan. Treat remediation as high priority, but not an internet-wide emergency: exploitation requires local access, and the supplied sources do not establish active exploitation. Resolve uncertain version boundaries through the operating-system vendor before declaring systems safe.
Technical view
Linkwatch work can race with lower-device unregistration because ipvlan->phy_dev may reference freed memory. ipvlan_get_iflink() then performs a four-byte read from the freed object. The cited kernel resolution extends core RCU protection in default_operstate(), assuming devices are brought down during unregistration.
Likely exposure
The supplied record identifies Linux kernel versions including 6.2, 6.6.72, 6.12.10, and 6.13 as affected, but its version-boundary details are incomplete. Risk is concentrated on systems using ipvlan where local users can initiate relevant networking operations. Confirm exact exposure using distribution advisories and kernel build provenance.
Exploitation context
The CVSS 3.1 score is 7.8 with local access, low privileges, low complexity, and no user interaction. The issue was demonstrated by syzbot with KASAN. The supplied record is not in KEV and provides no evidence of active exploitation or a public weaponized exploit.
Researcher notes
The reported KASAN trace identifies slab-use-after-free in ipvlan_get_iflink() during linkwatch_event processing on arm64. The race involves linkwatch querying interface state after lower-device unregistration. The source describes a core RCU-based correction rather than adding an ipvlan-held reference. Exploitability beyond the observed read is not established by the supplied evidence.
Mitigation direction
- Install a vendor-supported kernel containing the applicable cited stable fix.
- Check the Linux distribution's advisory for exact fixed package versions and reboot requirements.
- Restrict unnecessary local access and network-device administration until remediation is complete.
- If ipvlan is unused, consider disabling its availability according to vendor guidance.
Validation and detection
- Record the running kernel release, package version, architecture, and distribution build.
- Compare that build with the distribution's CVE advisory and fixed-version information.
- Verify whether the applicable stable fix is present in downstream kernel sources.
- Inventory hosts and workloads using ipvlan interfaces or dependent container networking.
- After updating and rebooting, confirm the active kernel matches the remediated package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21652 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ba9f7c16ec879c83bb4f80406773a911aace8267CVE reference, Linux
- https://git.kernel.org/stable/c/52a24538d569f48e79d1a169a5d359d384152950CVE reference, Linux
- https://git.kernel.org/stable/c/cb358ff94154774d031159b018adf45e17673941CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.