CVE-2025-21858

A use-after-free vulnerability exists in the Linux kernel. When dev_net is dismantled, the geneve_exit_batch_rtnl() function calls unregister_netdevice_queue() for each device in the network namespace. Later, when the device is freed, it is still linked to the backend UDP socket in the network namespace.

Red Hat Enterprise Linux is affected by a Moderate severity use-after-free flaw in the Linux kernel's GENEVE (Generic Network Virtualization Encapsulation) driver. When a GENEVE device is created with a backend UDP socket in a different network namespace (for example via IFLA_NET_NS_PID, IFLA_NET_NS_FD, or IFLA_TARGET_NETNSID), dismantling the device's own network namespace unregisters and frees the device while its geneve_dev structure remains linked in the backend UDP socket namespace's device list. Creating another GENEVE device in that namespace then dereferences the freed memory. A local attacker with the privileges needed to create and configure network devices could exploit this use-after-free to crash the system or potentially achieve other memory-corruption consequences such as privilege escalation. Red Hat Enterprise Linux 8 and 9 kernel and kernel-rt are affected, with fixes being pursued through the delegated maintenance process. Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those offerings. While NIST assigns this flaw a CVSS score of 7.8 (High), Red Hat's assessment is Moderate impact (CVSS 7.3, with lower integrity impact), reflecting the local and privileged nature of the attack vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.