CVE-2025-21999

A flaw was found in the Linux kernel. A race condition between unloading a kernel module and accessing its entry in the proc filesystem leads to a use-after-free vulnerability, where the kernel accesses memory that has already been released. A local user could exploit this timing issue during module removal, potentially causing a Denial of Service (DoS) via a system crash or escalating privileges.

This vulnerability is classified as having Moderate severity because exploitation requires winning a tight race condition during an administrative kernel module unload, limiting practical exploitability in typical enterprise environments. While unprivileged local users can query procfs entries, they cannot initiate module removal without administrative privileges, meaning the timing window depends on concurrent administrative actions. Consequently, the primary real-world risk is a local denial of service resulting from a kernel crash rather than reliable privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.