Security readout for executives and security teams
Plain-English summary
A Linux kernel networking function may access memory after it has been released because protection is acquired too late. Successful exploitation could seriously affect confidentiality, integrity, or availability, although the supplied evidence does not establish practical exploitation conditions or attacks in the wild.
Executive priority
Treat this as high-priority kernel maintenance, particularly for critical or network-facing Linux systems. Schedule prompt vendor-approved updates, but the supplied evidence does not justify claiming an active-exploitation emergency. Require asset owners to confirm the running kernel after remediation.
Technical view
CVE-2025-21760 is a CWE-416 use-after-free in ndisc_send_skb(). The function can run without RTNL or RCU protection. The kernel fix acquires rcu_read_lock() earlier, allowing dev_net_rcu() to be used safely. CVSS 3.1 is 8.1: network-accessible, unauthenticated, high-complexity, with potentially high confidentiality, integrity, and availability impact.
Likely exposure
Potential exposure exists on Linux systems running affected kernel builds where the vulnerable network-neighbour-discovery path is reachable. The supplied version data does not clearly distinguish introduced versions from fixed branch releases. Validate exposure through the applicable distribution or appliance advisory and corresponding stable-kernel fix, not version strings alone.
Exploitation context
The supplied record is not in KEV, and no cited source establishes active exploitation or a public proof of concept. The CVSS vector describes an unauthenticated network attack with high complexity and no user interaction. KEV absence does not prove exploitation is impossible.
Researcher notes
The record identifies a race-related RCU lifetime failure and CWE-416. Precise triggering conditions, affected-version boundaries, exploit reliability, and observable indicators are incomplete in the supplied bundle. The stable commits document the code-level correction, while Debian advisories provide downstream remediation context.
Mitigation direction
- Install a vendor-supported kernel package containing the applicable stable-kernel fix.
- Check distribution or appliance advisories for exact fixed package versions.
- Prioritize systems processing untrusted network traffic or supporting critical services.
- Reboot into the updated kernel when required by the vendor package process.
Validation and detection
- Inventory running kernel releases and vendor package versions across Linux assets.
- Map each build to its vendor advisory and applicable stable-kernel fix.
- Confirm the updated kernel is running, rather than merely installed.
- Regression-test network connectivity after updating, including IPv6 where enabled.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21760 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/10a1f3fece2f0d23a3a618b72b2b4e6f408ef7d1CVE reference, Linux
- https://git.kernel.org/stable/c/4d576202b90b1b95a7c428a80b536f91b8201bccCVE reference, Linux
- https://git.kernel.org/stable/c/e24d225e4cb8cf108bde00b76594499b98f0a74dCVE reference, Linux
- https://git.kernel.org/stable/c/a9319d800b5701e7f5e3fa71a5b7c4831fc20d6dCVE reference, Linux
- https://git.kernel.org/stable/c/ae38982f521621c216fc2f5182cd091f4734641dCVE reference, Linux
- https://git.kernel.org/stable/c/789230e5a8c1097301afc802e242c79bc8835c67CVE reference, Linux
- https://git.kernel.org/stable/c/04e05112f10354ffc3bb6cc796d553bab161594cCVE reference, Linux
- https://git.kernel.org/stable/c/ed6ae1f325d3c43966ec1b62ac1459e2b8e45640CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.