CVE-2025-21763

What it actually does

The vulnerability is a use-after-free in the Linux kernel's __neigh_notify() function caused by missing RCU or RTNL protection, allowing a freed neighbour structure to be accessed.

Why it matters to the business

Local attackers with low privileges can escalate to full system control on affected Linux systems, leading to data theft, service disruption, or persistent compromise; high prevalence in cloud and server environments increases urgency despite low EPSS.

How an attack unfolds

An attacker with local access triggers neighbour notification paths without proper locking, races the RCU grace period to free the structure, then reuses the dangling pointer to corrupt kernel memory or execute arbitrary code, similar to other recent kernel privilege escalation chains.

How to fix it

Update the Linux kernel to a version containing the RCU protection fix in __neigh_notify(); for oslo-utils (PyPI) environments also upgrade to version 4.10.1 or later.

How to confirm the fix worked

Verify kernel source contains RCU read-side protection around neighbour notification calls; run regression tests exercising neighbour table operations under concurrency; confirm oslo-utils package version is 4.10.1 or newer via package manager.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux kernel
2. Craft input or workload that invokes __neigh_notify() without RTNL/RCU
3. Trigger concurrent operation to free the neighbour object during notification
4. Reuse the dangling pointer for memory corruption or code execution
5. Escalate to root and establish persistence or exfiltrate data

How to detect it

Review kernel logs for use-after-free warnings or oops in neighbour code paths; inspect audit logs for unusual local process activity around network neighbour table manipulation; correlate with threat actor patterns seen in similar kernel privilege escalations.

What your security team should do

• Prioritize kernel updates on all Linux hosts within the next 30 days given local exploitability
• Audit systems for oslo-utils versions below 4.10.1 and apply the listed fixes
• Enable kernel hardening features such as KASAN and lockdep in test environments to catch similar UAF issues
• Monitor for new exploit maturity indicators as EPSS remains low but related kernel CVEs show active exploitation by multiple actors