PT-2025-4333 · Linux+4 · Linux Kernel+4
Syzkaller
·
Publicado
2025-01-07
·
Atualizado
2026-01-23
·
CVE-2025-21652
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
A use-after-free vulnerability has been identified in the Linux kernel, specifically in the ipvlan module. This issue arises when the linkwatch work is triggered for the ipvlan device, potentially resulting in the lower device being freed before the ipvlan device, leading to a use-after-free error in ipvlan get iflink(). The vulnerability can be addressed by delaying the unregistration of the lower device, similar to how it is handled in the vlan and macvlan modules.
Recommendations
Update to Linux kernel version 6.6.74 or later to resolve the issue.
As a temporary workaround, consider disabling the linkwatch work for ipvlan devices until a patch is available.
Exploit
Correção
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Linuxmint
Linux Kernel
Suse
Ubuntu