VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Feb 27, 2025· Updated May 12, 2026

CVE-2025-21766

CVE-2025-21766

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: use RCU protection in __ip_rt_update_pmtu()

__ip_rt_update_pmtu() must use RCU protection to make sure the net structure it reads does not disappear.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Missing RCU protection in Linux kernel's IPv4 __ip_rt_update_pmtu() can cause use-after-free, leading to denial of service or information disclosure.

CVE-2025-21766 is a vulnerability in the Linux kernel's IPv4 Path MTU Discovery (PMTU) function __ip_rt_update_pmtu(). The function lacks RCU protection when accessing the net structure, leading to a potential use-after-free condition [1]. This can occur when the net structure is freed while still in use by another thread.

Exploitation requires the ability to trigger PMTU updates, which can be achieved by sending packets with specific IP options or through network conditions that cause PMTU changes. An attacker with local access or the ability to send crafted packets could exploit this race condition. No authentication is required for network-based triggers.

Successful exploitation could allow an attacker to cause a denial of service (system crash) or potentially leak sensitive kernel memory. The vulnerability affects all Linux kernel versions prior to the fix, including those used in embedded systems and industrial devices like those from Siemens [1].

Patches have been applied to the mainline kernel and backported to stable branches as seen in commits [2][3][4]. Users should update to the latest kernel version or apply the respective patches.

References
  1. SSA-082556
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

173

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.