Security readout for executives and security teams
Plain-English summary
CVE-2025-21763 is a Linux kernel use-after-free flaw in neighbour notification handling. A local, low-privileged attacker may be able to impact confidentiality, integrity, and availability. It is serious for multi-user Linux systems, container hosts, and appliances that run affected kernels.
Executive priority
Prioritize remediation in the next normal emergency patch cycle for internet-facing service hosts, shared infrastructure, and systems running untrusted local workloads. No active exploitation is cited, but kernel memory-safety flaws can materially affect host control.
Technical view
The flaw is CWE-416 in Linux kernel __neigh_notify(). The CVE states the function can run without RTNL or RCU protection, creating potential use-after-free risk. Stable kernel commits resolve it by adding RCU protection. CVSS 3.1 is 7.8 with local attack vector and low privileges required.
Likely exposure
Exposure is likely on systems running affected Linux kernel versions or vendor products built on those kernels. The bundle lists Linux 2.6.25 through multiple stable branches as affected, with fixed stable commits referenced. Confirm against your distribution kernel package, not only upstream version numbers.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The CVSS vector indicates local access with low privileges and no user interaction. Treat this mainly as a local privilege and host-compromise risk until vendor advisories provide more specific exploitation evidence.
Researcher notes
Focus validation on neighbour subsystem patch presence and vendor backport status. The available sources identify the vulnerable function and fix direction, but do not provide exploit details, affected distribution package matrices, or proof of active exploitation.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Prioritize shared Linux servers, container hosts, and systems with local user access.
- Review Debian LTS advisories if running Debian-derived systems.
- Check appliance and OEM advisories for embedded Linux exposure.
- Use vendor guidance where package backports obscure upstream version numbers.
Validation and detection
- Inventory Linux kernel versions across servers, containers hosts, and appliances.
- Map installed kernel packages to vendor advisories and fixed builds.
- Confirm whether your kernel includes the RCU protection commits.
- Review EDR or audit logs for suspicious local privilege activity.
- Track CVE and vendor advisories for exploitation-status changes.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit e1aed6be
- Linux stable commit 8666e9aa
- Linux stable commit 40d8f2f2
- Linux stable commit 784eb237
- Linux stable commit 1cbb2aa9
- Linux stable commit cdd5c2a1
- Linux stable commit 559307d2
- Linux stable commit becbd585
- Debian LTS announcement May 2025
- Debian LTS announcement March 2025
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21763 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e1aed6be381bcd7f46d4ca9d7ef0f5f3d6a1be32CVE reference, Linux
- https://git.kernel.org/stable/c/8666e9aab801328c1408a19fbf4070609dc0695aCVE reference, Linux
- https://git.kernel.org/stable/c/40d8f2f2a373b6c294ffac394d2bb814b572ead1CVE reference, Linux
- https://git.kernel.org/stable/c/784eb2376270e086f7db136d154b8404edacf97bCVE reference, Linux
- https://git.kernel.org/stable/c/1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379CVE reference, Linux
- https://git.kernel.org/stable/c/cdd5c2a12ddad8a77ce1838ff9f29aa587de82dfCVE reference, Linux
- https://git.kernel.org/stable/c/559307d25235e24b5424778c7332451b6c741159CVE reference, Linux
- https://git.kernel.org/stable/c/becbd5850c03ed33b232083dd66c6e38c0c0e569CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.