CVE-2025-21762: arp: use RCU protection in arp_xmit()
First published: Thu Feb 27 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | >=4.4<5.4.291 | |
| Linux Kernel | >=5.5<5.10.235 | |
| Linux Kernel | >=5.11<5.15.179 | |
| Linux Kernel | >=5.16<6.1.129 | |
| Linux Kernel | >=6.2<6.6.79 | |
| Linux Kernel | >=6.7<6.12.16 | |
| Linux Kernel | >=6.13<6.13.4 | |
| Linux Kernel | =6.14-rc1 | |
| Linux Kernel | =6.14-rc2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe
- https://git.kernel.org/stable/c/2c331718d3389b6c5f6855078ab7171849e016bd
- https://git.kernel.org/stable/c/a42b69f692165ec39db42d595f4f65a4c8f42e44
- https://git.kernel.org/stable/c/e9f4dee534eb1b225b0a120395ad9bc2afe164d3
- https://git.kernel.org/stable/c/f189654459423d4d48bef2d120b4bfba559e6039
- https://git.kernel.org/stable/c/10f555e3f573d004ae9d89b3276abb58c4ede5c3
- https://git.kernel.org/stable/c/307cd1e2d3cb1cbc6c40c679cada6d7168b18431
- https://git.kernel.org/stable/c/d9366ac2f956a1948b68c0500f84a3462ff2ed8a
Frequently Asked Questions
What is the severity of CVE-2025-21762?
CVE-2025-21762 has a moderate severity level due to the potential for use-after-free (UAF) vulnerabilities.
How do I fix CVE-2025-21762?
To fix CVE-2025-21762, ensure you are using the updated version of the Linux kernel that applies RCU protection in arp_xmit().
What systems are affected by CVE-2025-21762?
CVE-2025-21762 affects systems running the Linux kernel without the specified protections for the arp_xmit() function.
What kind of vulnerability is CVE-2025-21762?
CVE-2025-21762 is a use-after-free (UAF) vulnerability due to improper protection in the arp_xmit() function.
When was CVE-2025-21762 disclosed?
CVE-2025-21762 was disclosed in early 2025 following the identification of inadequate RCU protection.
- agent/first-publish-date
- agent/type
- agent/title
- agent/author
- agent/source
- agent/description
- agent/severity
- agent/weakness
- agent/guess-ai
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/references
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/linux
- canonical/linux kernel
- version/linux kernel/4.4
- version/linux kernel/5.5
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.13
- version/linux kernel/6.14-rc1
- version/linux kernel/6.14-rc2