Back
CVE-2025-21763neighbour: use RCU protection in __neigh_notify()
- 7.8HighCVSS base score
- 0.26%Exploitation in 30 daysEPSS · top 82% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
Timeline
ID reserved
By Linux
- 2 months later
· 2 months later
Published
- 20 months later
· 20 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CISA-ADPADP (enrichment) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.26% · top 82% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 426b5303eb435d98b9bee37a807be386bc2b3320 – < e1aed6be381bcd7f46d4ca9d7ef0f5f3d6a1be32
- affected 426b5303eb435d98b9bee37a807be386bc2b3320 – < 8666e9aab801328c1408a19fbf4070609dc0695a
- affected 426b5303eb435d98b9bee37a807be386bc2b3320 – < 40d8f2f2a373b6c294ffac394d2bb814b572ead1
- affected 426b5303eb435d98b9bee37a807be386bc2b3320 – < 784eb2376270e086f7db136d154b8404edacf97b
- affected 426b5303eb435d98b9bee37a807be386bc2b3320 – < 1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379
- affected 426b5303eb435d98b9bee37a807be386bc2b3320 – < cdd5c2a12ddad8a77ce1838ff9f29aa587de82df
- affected 426b5303eb435d98b9bee37a807be386bc2b3320 – < 559307d25235e24b5424778c7332451b6c741159
- affected 426b5303eb435d98b9bee37a807be386bc2b3320 – < becbd5850c03ed33b232083dd66c6e38c0c0e569
- affected 2.6.25
- unaffected < 2.6.25
- unaffected 5.4.291 – ≤ 5.4.*
- unaffected 5.10.235 – ≤ 5.10.*
- unaffected 5.15.179 – ≤ 5.15.*
- unaffected 6.1.129 – ≤ 6.1.*
- unaffected 6.6.79 – ≤ 6.6.*
- unaffected 6.12.16 – ≤ 6.12.*
- unaffected 6.13.4 – ≤ 6.13.*
- unaffected 6.14 – ≤ *
References
References12
- https://git.kernel.org/stable/c/e1aed6be381bcd7f46d4ca9d7ef0f5f3d6a1be32 (opens in a new tab)
- https://git.kernel.org/stable/c/8666e9aab801328c1408a19fbf4070609dc0695a (opens in a new tab)
- https://git.kernel.org/stable/c/40d8f2f2a373b6c294ffac394d2bb814b572ead1 (opens in a new tab)
- https://git.kernel.org/stable/c/784eb2376270e086f7db136d154b8404edacf97b (opens in a new tab)
- https://git.kernel.org/stable/c/1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379 (opens in a new tab)
- https://git.kernel.org/stable/c/cdd5c2a12ddad8a77ce1838ff9f29aa587de82df (opens in a new tab)
- https://git.kernel.org/stable/c/559307d25235e24b5424778c7332451b6c741159 (opens in a new tab)
- https://git.kernel.org/stable/c/becbd5850c03ed33b232083dd66c6e38c0c0e569 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-5167 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-21763)Record last updated .