CVE-2025-21766

What it actually does

Use-after-free vulnerability in the Linux kernel IPv4 routing code where __ip_rt_update_pmtu() reads the net structure without RCU protection, allowing the structure to be freed while still in use.

Why it matters to the business

Local users can trigger kernel instability or crashes on affected systems, leading to service disruption and requiring reboots; high ecosystem prevalence in Linux distributions increases exposure across servers and cloud workloads.

How an attack unfolds

A local attacker with low privileges crafts network operations that invoke __ip_rt_update_pmtu() while concurrently triggering net structure teardown, dereferencing freed memory to cause denial of service; related kernel privilege escalation patterns seen in similar CVEs could extend impact.

How to fix it

Upgrade the Linux kernel to the fixed commit ce3c6165fce0f06305c806696882a3ad4b90e33f or later stable releases containing the RCU protection change in __ip_rt_update_pmtu().

How to confirm the fix worked

Confirm kernel source contains RCU read-side critical section around net structure access in __ip_rt_update_pmtu(); test by exercising PMTU updates under net namespace deletion workloads and verify absence of use-after-free warnings in dmesg or KASAN.

Typical attack path

1. Obtain local low-privileged access on a vulnerable Linux system
2. Trigger concurrent network route PMTU updates and net namespace teardown
3. Force dereference of freed net structure in __ip_rt_update_pmtu()
4. Cause kernel panic or oops leading to system reboot or hang

How to detect it

Review kernel logs for oops or panic messages referencing __ip_rt_update_pmtu or net structure dereference; inspect audit logs for unusual local network configuration changes preceding crashes.

What your security team should do

• Prioritize kernel updates on all exposed Linux hosts within standard patch windows given low EPSS but local attack surface
• Monitor for similar RCU-related fixes in upcoming kernel releases
• Restrict local user access where possible to reduce exploitation likelihood