Linux: Use After Free
CVE-2025-21858 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d5e86e27de0936f3cb0a299ce519d993e9cf3886, 5a0538ac6826807d6919f6aecbb8996c2865af2c, f74f6560146714241c6e167b03165ee77a86e316 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.25% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to d5e86e27de0936f3cb0a299ce519d993e9cf3886 or 5a0538ac6826807d6919f6aecbb8996c2865af2c or f74f6560146714241c6e167b03165ee77a86e316 or 904e746b2e7fa952ab8801b303ce826a63153d78, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.1.130 or 6.6.80 or 6.12.17 or 6.13.5, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b up to, but not including, d5e86e27de0936f3cb0a299ce519d993e9cf3886; 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b up to, but not including, 5a0538ac6826807d6919f6aecbb8996c2865af2c; 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b up to, but not including, f74f6560146714241c6e167b03165ee77a86e316; 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b up to, but not including, 904e746b2e7fa952ab8801b303ce826a63153d78; 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b up to, but not including, 3ce92ca990cfac88a87c61df3cc0b5880e688ecf; 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b up to, but not including, da9b0ae47f084014b1e4b3f31f70a0defd047ff3; 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b up to, but not including, 788dbca056a8783ec063da3c9d49a3a71c76c283; 2d07dc79fe04a43d82a346ced6bbf07bdb523f1b up to, but not including, 9593172d93b9f91c362baec4643003dc29802929; and 1 more ranges | d5e86e27de0936f3cb0a299ce519d993e9cf3886, 5a0538ac6826807d6919f6aecbb8996c2865af2c, f74f6560146714241c6e167b03165ee77a86e316, 904e746b2e7fa952ab8801b303ce826a63153d78, 3ce92ca990cfac88a87c61df3cc0b5880e688ecf, da9b0ae47f084014b1e4b3f31f70a0defd047ff3 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | all versions | Not stated |
| Linux | Linux Kernel | 4.2 up to, but not including, 6.1.130; 6.2 up to, but not including, 6.6.80; 6.7 up to, but not including, 6.12.17; 6.13 up to, but not including, 6.13.5; 6.14 | 6.1.130, 6.6.80, 6.12.17, 6.13.5 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
| CVSS 3.1 | 7.8 | High | CISA (ADP) |
Official description
In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net, geneve_net_id)->geneve_list. The net here could differ from dev_net(dev) if IFLA_NET_NS_PID, IFLA_NET_NS_FD, or IFLA_TARGET_NETNSID is set. When dev_net(dev) is dismantled, geneve_exit_batch_rtnl() finally calls unregister_netdevice_queue() for each dev in the netns, and later the dev is freed. However, its geneve_dev.next is still linked to the backend UDP socket netns. Then, use-after-free will occur when another geneve dev is created in the netns. Let's call geneve_dellink() instead in geneve_destroy_tunnels(). [0]: BUG: KASAN: slab-use-after-free in geneve_find_dev drivers/net/geneve.c:1295 [inline] BUG: KASAN: slab-use-after-free in geneve_configure+0x234/0x858 drivers/net/geneve.c:1343 Read of size 2 at addr ffff000054d6ee24 by task syz.1.4029/13441 CPU: 1 UID: 0 PID: 13441 Comm: syz.1.4029 Not tainted 6.13.0-g0ad9617c78ac #24 dc35ca22c79fb82e8e7bc5c9c9adafea898b1e3d Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x16c/0x6f0 mm/kasan/report.c:489 kasan_report+0xc0/0x120 mm/kasan/report.c:602 __asan_report_load2_noabort+0x20/0x30 mm/kasan/report_generic.c:379 geneve_find_dev drivers/net/geneve.c:1295 [inline] geneve_configure+0x234/0x858 drivers/net/geneve.c:1343 geneve_newlink+0xb8/0x128 drivers/net/geneve.c:1634 rtnl_newlink_create+0x23c/0x868 net/core/rtnetlink.c:3795 __rtnl_newlink net/core/rtnetlink.c:3906 [inline] rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021 rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:713 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x410/0x6f8 net/socket.c:2568 ___sys_sendmsg+0x178/0x1d8 net/socket.c:2622 __sys_sendmsg net/socket.c:2654 [inline] __do_sys_sendmsg net/socket.c:2659 [inline] __se_sys_sendmsg net/socket.c:2657 [inline] __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2657 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151 el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600 Allocated by task 13247: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x68 mm/kasan/common.c:68 kasan_save_alloc_info+0x44/0x58 mm/kasan/generic.c:568 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4298 [inline] __kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4304 __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:645 alloc_netdev_mqs+0xb8/0x11a0 net/core/dev.c:11470 rtnl_create_link+0x2b8/0xb50 net/core/rtnetlink.c:3604 rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3780 __rtnl_newlink net/core/rtnetlink.c:3906 [inline] rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021 rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911 netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543 rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938 netlink_unicast_kernel net/netlink/af_n ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/3ce92ca990cfac88a87c61df3cc0b5880e688ecf
- git.kernel.org/stable/c/5a0538ac6826807d6919f6aecbb8996c2865af2c
- git.kernel.org/stable/c/788dbca056a8783ec063da3c9d49a3a71c76c283
- git.kernel.org/stable/c/904e746b2e7fa952ab8801b303ce826a63153d78
- git.kernel.org/stable/c/9593172d93b9f91c362baec4643003dc29802929
- git.kernel.org/stable/c/d5e86e27de0936f3cb0a299ce519d993e9cf3886
- git.kernel.org/stable/c/da9b0ae47f084014b1e4b3f31f70a0defd047ff3
- git.kernel.org/stable/c/f74f6560146714241c6e167b03165ee77a86e316
Other references
Recent Use After Free vulnerabilities
- 9.8 Critical severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.