CVE-2025-21764

What it actually does

Use-after-free in ndisc_alloc_skb() caused by missing RCU protection when the function is invoked without RTNL or RCU held, allowing a freed object to be dereferenced.

Why it matters to the business

Local attackers can escalate privileges to root on affected Linux systems, leading to full host compromise, data theft, or persistence; 98 downstream dependents increase blast radius across the ecosystem.

How an attack unfolds

An attacker with local access crafts network or neighbor discovery events that invoke ndisc_alloc_skb() concurrently with object freeing, leveraging the UAF for memory corruption and privilege escalation; similar techniques have been observed in campaigns targeting related Linux kernel CVEs by multiple threat actors.

How to fix it

Update affected tensorflow packages to version 2.3.4 or later; for Linux kernel deployments, apply the RCU protection patch or upgrade to a kernel containing the fix; prioritize systems with high downstream dependency counts.

How to confirm the fix worked

Verify the ndisc_alloc_skb() call sites are now wrapped with RCU read locks; confirm package version reports 2.3.4 or newer; run kernel regression tests exercising neighbor discovery paths under concurrent load.

Typical attack path

1. Gain local unprivileged access to a vulnerable Linux host
2. Trigger concurrent ndisc operations that allocate and free skbs without RCU
3. Exploit the resulting UAF to corrupt kernel memory structures
4. Escalate to root and execute arbitrary code or install persistence

How to detect it

Review kernel logs and audit trails for unusual neighbor discovery or ndisc activity coinciding with crashes or privilege changes; correlate with process creation events from local users; watch for patterns seen in prior kernel privilege-escalation campaigns by listed threat actors.

What your security team should do

• Immediately upgrade tensorflow to 2.3.4 across all environments due to ecosystem prevalence
• Monitor for similar kernel UAF patterns reported in related privilege-escalation CVEs
• Apply kernel updates containing the ndisc RCU fix within standard patch windows
• Harden local access controls and limit unprivileged users on exposed systems