Use-after-free in Linux kernel bpf

1) Use-after-free

EUVDB-ID: #VU106112

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21867

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the bpf_test_init() function in net/bpf/test_run.c. A local user can escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/1a9e1284e87d59b1303b69d1808d310821d6e5f7
https://git.kernel.org/stable/c/6b3d638ca897e099fa99bd6d02189d3176f80a47
https://git.kernel.org/stable/c/972bafed67ca73ad9a56448384281eb5fd5c0ba3
https://git.kernel.org/stable/c/d56d8a23d95100b65f40438639dd82db2af81c11
https://git.kernel.org/stable/c/f615fccfc689cb48977d275ac2e391297b52392b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.