LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out()

In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_out() Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2025-21791 is a Linux kernel use-after-free flaw in VRF networking code. A local, low-privileged user could potentially affect confidentiality, integrity, and availability on vulnerable systems. It is not marked as CISA KEV in the provided data, so active exploitation is not established here.

Executive priority

Treat as a high-priority kernel update for exposed Linux fleets, especially shared or multi-tenant systems. It is not currently evidenced as actively exploited in the provided sources, but the impact rating supports timely remediation during the next urgent patch cycle.

Technical view

The bug is in l3mdev_l3_out(), which may be reached from raw_sendmsg() without RCU protection. Kernel fixes add rcu_read_lock()/rcu_read_unlock() to prevent a potential use-after-free. The CVSS v3.1 score is 7.8, local attack vector, low complexity, low privileges, no user interaction.

Likely exposure

Exposure is mainly Linux hosts running affected kernel branches, especially systems using or loading VRF/l3mdev networking paths. The provided data lists affected Linux versions including 4.9 and fixed-line releases around 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.79, 6.12.16, 6.13.4, and 6.14.

Exploitation context

The issue requires local access with low privileges. The provided sources do not show public exploit availability or confirmed active exploitation. Business risk is higher on multi-user servers, shared compute, containers with meaningful kernel attack surface, or environments where untrusted users can run local code.

Researcher notes

This is CWE-416 in Linux VRF output path handling. The fix is synchronization-focused, adding RCU read-side protection around l3mdev_l3_out(). Validate downstream distribution backports rather than relying only on upstream version numbers, because vendors may patch older kernels without changing major versions.

Mitigation direction

  • Update to a kernel containing the referenced stable fixes.
  • Apply Debian LTS kernel updates where applicable.
  • Prioritize shared, multi-user, and untrusted workload hosts.
  • Check your Linux distribution advisory for exact fixed package versions.
  • If immediate patching is impossible, reduce local untrusted user access.

Validation and detection

  • Inventory Linux kernel versions across servers and appliances.
  • Compare installed kernels with vendor fixed versions and stable commits.
  • Confirm Debian systems have relevant LTS security updates installed.
  • Identify hosts using VRF or l3mdev networking features.
  • Monitor vendor advisories for revised affected-version guidance.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-416: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-21791 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-21791Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa8e3e1a9f02094145580ea7920c6a1d9aabd5539, a8e3e1a9f02094145580ea7920c6a1d9aabd5539, a8e3e1a9f02094145580ea7920c6a1d9aabd5539, a8e3e1a9f02094145580ea7920c6a1d9aabd5539, a8e3e1a9f02094145580ea7920c6a1d9aabd5539, a8e3e1a9f02094145580ea7920c6a1d9aabd5539, a8e3e1a9f02094145580ea7920c6a1d9aabd5539, a8e3e1a9f02094145580ea7920c6a1d9aabd5539unaffected
LinuxLinux4.9, 0, 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.79, 6.12.16, 6.13.4, 6.14affected
Weakness

CWE details

CWE-416

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-416 · source CWE mapping

Use After Free

Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs