CVE-2025-21791

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved. The issue is related to the function l3mdev l3 out(), which can be called without RCU protection. This can lead to a potential use-after-free (UAF) issue. The vulnerability is exploited through a sequence of function calls, including raw sendmsg(), ip push pending frames(), ip send skb(), ip local out(), and ip local out(), ultimately calling l3mdev ip out(). To address this, an rcu read lock() / rcu read unlock() pair has been added.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.