CVE-2025-21765

What it actually does

Missing RCU protection in ip6_default_advmss() allows the net structure to disappear while being read, creating a race condition that results in use-after-free and denial of service (availability impact).

Why it matters to the business

Potential system instability or crashes on affected Linux systems, with 4 downstream dependents increasing exposure across the ecosystem; urgency remains low given false KEV status and flat EPSS trend over 608 days since publication.

How an attack unfolds

A local attacker triggers concurrent IPv6 operations to exploit the unprotected read of the net structure in ip6_default_advmss(), potentially leading to crashes; context from related Linux kernel privilege escalation campaigns by threat actors highlights similar patterns though this CVE itself is not KEV-listed.

How to fix it

Update affected ansible (PyPI) packages to version 2.9.18; apply corresponding Linux kernel patches that implement RCU protection in ip6_default_advmss().

How to confirm the fix worked

Confirm kernel source contains RCU read-side critical sections around net structure access in ip6_default_advmss(); verify ansible package version is 2.9.18 or later via package manager.

Typical attack path

1. Gain local user access on a vulnerable Linux system
2. Trigger concurrent IPv6 network configuration or packet handling
3. Force the net structure to be freed during ip6_default_advmss() execution
4. Cause kernel crash or denial of service

How to detect it

Inspect kernel logs for oops or panic messages referencing ip6_default_advmss and net structure; correlate with IPv6 activity timestamps; review related privilege escalation attempts noted in threat actor campaigns.

What your security team should do

• Prioritize kernel updates on all Linux systems handling IPv6 traffic
• Review ecosystem dependents for downstream impact
• Monitor EPSS and threat actor activity on related kernel CVEs