CVE-2025-21761: openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: use RCU protection in ovsvportcmdfillinfo()
ovsvportcmdfillinfo() can be called without RTNL or RCU.
Use RCU protection and devnetrcu() to avoid potential UAF.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21761?
CVE-2025-21761 has a moderate severity level due to its potential for use-after-free vulnerabilities in the Linux kernel's Open vSwitch.
How do I fix CVE-2025-21761?
To fix CVE-2025-21761, update the Linux kernel and Open vSwitch to the latest patched versions that include RCU protection in the ovs_vport_cmd_fill_info() function.
What software is affected by CVE-2025-21761?
CVE-2025-21761 affects the Linux kernel and Open vSwitch due to improper handling in the ovs_vport_cmd_fill_info() function.
What causes CVE-2025-21761?
CVE-2025-21761 is caused by the lack of RCU protection and RTNL locking in the ovs_vport_cmd_fill_info() function, which can lead to potential use-after-free conditions.
Is CVE-2025-21761 being actively exploited?
As of the current information available, there are no reports of active exploitation of CVE-2025-21761, but it is recommended to apply patches to mitigate risks.