CVE-2025-21760

A flaw was found in the Linux kernel. The ndisc_send_skb() function, responsible for handling Neighbor Discovery (ND) messages in IPv6, can be called without proper Read-Copy-Update (RCU) protection. This missing protection can lead to a Use-After-Free (UAF) vulnerability. A Use-After-Free vulnerability occurs when a program attempts to use memory after it has been freed, which can lead to system instability or potentially arbitrary code execution.

This vulnerability is rated as having a Moderate impact because triggering the race condition requires local network namespace or interface operations with authenticated user access, primarily resulting in a kernel crash (denial of service). Although IPv6 neighbor discovery is active by default across standard Red Hat Enterprise Linux installations, exploiting this use-after-free condition to achieve arbitrary code execution or privilege escalation is complex and improbable in typical deployment environments. Consequently, the flaw poses an availability risk to the host system rather than broad system compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.