VYPR
← All advisories
High severity7.8NVD Advisory· Published Feb 27, 2025· Updated May 12, 2026

CVE-2025-21763

CVE-2025-21763

Description

In the Linux kernel, the following vulnerability has been resolved:

neighbour: use RCU protection in __neigh_notify()

__neigh_notify() can be called without RTNL or RCU protection.

Use RCU protection to avoid potential UAF.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, __neigh_notify() could be invoked without proper synchronization, leading to a potential use-after-free.

Vulnerability

CVE-2025-21763 is a use-after-free (UAF) vulnerability in the Linux kernel's neighbour subsystem. The function __neigh_notify() could be called without either the RTNL lock or RCU protection, leaving it exposed to concurrent memory operations. This missing synchronization means that while one code path might be freeing a neighbour entry, another could still be accessing it through the notification path [1].

Exploitation

An attacker does not need authenticated access to exploit this issue locally. The primitive is reachable from any context that triggers a neighbour event notification, which can be provoked by network activity on the local system. Because RTNL or RCU protection was not enforced, the attacker can race a neighbour entry deletion against a notification callback to cause a dangling pointer reference [1].

Impact

Successful exploitation of this race condition can lead to a use-after-free, which typically results in a kernel crash (denial of service) or, in more advanced scenarios, arbitrary code execution with kernel privileges. The CVSSv3 score of 7.8 (High) reflects the high potential for system compromise once the primitive is reliably triggered [1].

Mitigation

The fix has been applied in the Linux kernel stable tree, and updates are available from distributions. Users should upgrade to a kernel version containing the commit that introduces proper RCU protection in __neigh_notify(). Siemens has listed this CVE as affecting the GNU/Linux subsystem of SIMATIC S7-1500 TM MFP products, recommending timely patching [1].

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

89

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.