CVE-2025-21763

CVE-2025-21763 is a use-after-free (UAF) vulnerability, classified under CWE-416, in the Linux kernel's neighbour subsystem. The issue arises because the __neigh_notify() function can be called without proper RTNL or RCU protection, potentially leading to a UAF condition. It affects Linux kernel versions prior to the application of the relevant stable patches and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution, data corruption, or system crashes within the kernel context.

The vulnerability has been addressed through kernel patches available in the Linux stable repository. Key commits include 1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379, 40d8f2f2a373b6c294ffac394d2bb814b572ead1, 559307d25235e24b5424778c7332451b6c741159, 784eb2376270e086f7db136d154b8404edacf97b, and 8666e9aab801328c1408a19fbf4070609dc0695a, which implement RCU protection in __neigh_notify() to prevent the UAF. Security practitioners should update to kernels incorporating these fixes.