CVE-2025-21791

A use-after-free vulnerability was found in the Linux kernel. l3mdev_l3_out() can be called without RCU being held, causing damage to the availability of the system.

This vulnerability is rated as Moderate impact because exploitation requires local access and active Virtual Routing and Forwarding (VRF) configurations, limiting exposure to systems utilizing advanced network routing. On default Red Hat Enterprise Linux installations, VRF interfaces are not configured, leaving standard networking paths unaffected. A local user with raw socket privileges could potentially trigger a race condition during packet transmission, leading to a system crash or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.