Security readout for executives and security teams
Plain-English summary
A Linux kernel IPv6 multicast function could access network data after it has been freed, potentially allowing a local authenticated user to compromise confidentiality, integrity, or availability. The supplied CVSS score is 7.8. Practical exploitability and real-world impact are not established by the provided sources.
Executive priority
Treat as a high-priority kernel maintenance issue, especially where untrusted local users can access Linux hosts. Schedule prompt updates through normal change control. Emergency isolation is not justified by the supplied evidence because exploitation in the wild is not reported and practical exploitability remains uncertain.
Technical view
CVE-2025-21759 is a potential use-after-free in igmp6_send(). The function may run without RTNL or RCU protection, making retrieval and use of the network pointer unsafe. The stable fixes extend RCU coverage, allocate the packet buffer differently, and charge the IPv6 IGMP socket while protected.
Likely exposure
Exposure applies to affected Linux kernels using the vulnerable IPv6 multicast implementation. The bundle lists affected releases from 2.6.26 and identifies 6.6.79, 6.12.16, 6.13.4, and 6.14, but its version-range semantics are incomplete. Confirm exposure using distribution advisories and backport records.
Exploitation context
The CVSS vector describes local access, low complexity, low privileges, and no user interaction. The supplied record does not identify public exploitation, and KEV is false. No cited evidence establishes reliable code execution or attacks in the wild; the documented condition is a potential use-after-free.
Researcher notes
The flaw concerns lifetime protection around net access in igmp6_send(), with CWE-416 classification. Review downstream patches for equivalent extended RCU protection and the alloc_skb-based charging change. The source bundle contains duplicate commit identifiers and ambiguous version entries, so exact affected ranges require vendor confirmation.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix or downstream backport.
- Check distribution advisories because package versions may not match upstream kernel release numbers.
- Prioritize shared, multi-user, and otherwise untrusted Linux systems for remediation.
- Reboot into the updated kernel after installation, following vendor operational guidance.
Validation and detection
- Inventory running kernel versions across Linux hosts, containers' hosts, appliances, and virtual machines.
- Compare each kernel against vendor advisories and documented backport status for CVE-2025-21759.
- After remediation, verify the running kernel is the intended updated build.
- Confirm the vendor kernel source includes the relevant stable fix or an equivalent backport.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21759 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5aCVE reference, Linux
- https://git.kernel.org/stable/c/0bf8e2f3768629d437a32cb824149e6e98254381CVE reference, Linux
- https://git.kernel.org/stable/c/8e92d6a413feaf968a33f0b439ecf27404407458CVE reference, Linux
- https://git.kernel.org/stable/c/087c1faa594fa07a66933d750c0b2610aa1a2946CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.