CVE-2025-21760

CVE-2025-21760 is a use-after-free (CWE-416) in the Linux kernel's IPv6 Neighbor Discovery code: ndisc_send_skb() can be reached without RTNL or RCU read-side protection held, so a concurrent teardown (such as interface or network-namespace removal) can free memory the send path is still using. The fix acquires rcu_read_lock() earlier so that dev_net_rcu() can be used safely, closing the race window. A successful race could corrupt kernel memory and, per the CVSS vector (AV:N, AC:H), compromise the confidentiality, integrity, and availability of the host, although the high attack complexity makes reliable exploitation difficult. Any Linux system with IPv6 enabled is exposed in principle, which covers most servers, cloud instances, containers, Android devices, and embedded Linux deployments. No public proof-of-concept or confirmed in-the-wild exploitation is known, but a 36.8% EPSS score (98th percentile) indicates a materially elevated likelihood of exploitation within 30 days.

What to do: Apply your distribution's or vendor's latest kernel security update containing the upstream fix "ndisc: extend RCU protection in ndisc_send_skb()" and verify the running kernel version afterward. Prioritize internet-facing and IPv6-enabled hosts; because this is a hard-to-hit timing race rather than a straightforwardly packet-triggered bug, there is no dependable configuration-level mitigation beyond patching.