CVE-2026-21525

What it actually does

This vulnerability is a local denial-of-service flaw caused by a null pointer dereference. An attacker with local access can trigger the vulnerable code path without privileges or user interaction, causing the affected service, kernel component, or host subsystem to crash and potentially disrupting availability. The CVSS vector indicates no confidentiality or integrity impact, but high availability impact.

Why it matters to the business

Successful exploitation can interrupt remote access, networking, or system availability on affected hosts, potentially causing user lockouts, failed connections, service outages, and operational downtime. The issue is listed in the Known Exploited Vulnerabilities catalog with active exploitation observed, so remediation should be treated as time-sensitive even though the direct impact is denial of service rather than data theft. CISA’s listed remediation due date is 2026-03-03.

How an attack unfolds

An attacker first obtains the ability to run code or invoke local interfaces on an affected system. They then trigger the vulnerable local code path in the affected remote access or operating-system component using crafted local requests or inputs that cause a null pointer to be dereferenced. When the vulnerable component attempts to access invalid memory, it crashes, restarts, or causes broader system instability. In a real intrusion, this may be used to disrupt access, force service restarts, degrade monitoring visibility, or create operational pressure while other activity occurs.

How to fix it

Apply the vendor-provided fixed versions as soon as possible. For the supplied affected Debian packages, upgrade linux on Debian 12, Debian 13, and Debian 14 to version 6.0.7-1 or later. Reboot systems where required so the fixed kernel or affected component is actually loaded. For Windows Remote Access Connection Manager exposure described by the vulnerability text, apply the relevant Microsoft security update and verify the Remote Access Connection Manager component is no longer at a vulnerable build. Where immediate patching is not possible, restrict local interactive and shell access, reduce unnecessary user privileges, disable unneeded remote access services, monitor for repeated crashes, and prioritize high-availability systems for maintenance windows.

How to confirm the fix worked

Confirm installed package or component versions are at or above the fixed release. On Debian-based systems, verify the installed linux package version is 6.0.7-1 or later and confirm the running kernel matches the updated package after reboot. On Windows systems, verify the applicable security update is installed and the Remote Access Connection Manager-related binaries are at patched versions. Validate that the affected service or system component no longer crashes when exercised under normal operational testing. Review system uptime, service restart history, kernel logs, crash dumps, and application error logs after patching to ensure no continued null pointer dereference crashes are occurring.

Typical attack path

1. Gain local access to an affected host or execute code through an existing foothold.
2. Identify that the host is running a vulnerable affected version.
3. Invoke the vulnerable local component or interface with crafted input that reaches the null pointer dereference condition.
4. Cause the affected service, kernel component, or host to crash or become unstable.
5. Repeat exploitation to maintain a denial-of-service condition or to interfere with normal operations and response activity.

How to detect it

To determine whether exploitation already occurred, review operating-system logs, service crash records, kernel logs, crash dumps, and endpoint telemetry for unexpected crashes tied to the affected component. On Windows, inspect System and Application Event Logs for Service Control Manager events showing Remote Access Connection Manager or RasMan termination, Windows Error Reporting entries for svchost.exe crashes associated with RasMan, and repeated service restarts or unexpected reboots. On Debian or Linux systems, review journalctl, syslog, kern.log, dmesg, crash dumps, and kdump output for null pointer dereference, kernel oops, panic, or general protection fault messages near the time of outages. Correlate crash timestamps with local logon events, sudo or privilege-use events, process execution telemetry, shell history, scheduled task or cron changes, and EDR process trees. Because this is primarily a denial-of-service issue, strong indicators are repeated crash loops, service restarts, kernel oops messages, and suspicious local activity shortly before those events rather than network-only artifacts.

• NULL pointer dereference
• Unable to handle kernel NULL pointer dereference
• BUG: kernel NULL pointer dereference
• kernel NULL pointer dereference
• Oops: 0000
• general protection fault
• kernel panic - not syncing
• RasMan
• Remote Access Connection Manager
• svchost.exe_RasMan
• Faulting application name: svchost.exe
• Faulting module name: rasman.dll
• Service Control Manager
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Windows Error Reporting
• /var/log/kern.log
• /var/log/syslog
• journalctl -k
• /var/crash/
• /var/lib/systemd/coredump/

What your security team should do

• Prioritize remediation because this vulnerability is KEV-listed and marked as actively exploited in the wild.
• Patch affected Debian linux packages to 6.0.7-1 or later and reboot to load the fixed component.
• For Windows Remote Access Connection Manager exposure, apply the applicable Microsoft security update and confirm patched build levels.
• Inventory systems that allow local user execution, shared shell access, VPN or remote-access roles, jump hosts, and multi-user servers, as these are higher-risk for local denial-of-service abuse.
• Create detections for repeated service crashes, kernel null pointer dereference messages, unexpected reboots, and Remote Access Connection Manager failures.
• Review crash and authentication logs for signs of suspicious local activity immediately preceding outages or service failures.
• If patching is delayed, limit local logon rights, remove unnecessary users, restrict scheduled task or service creation rights, and increase monitoring of affected hosts.