CVE-2025-21759: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21759 affects the Linux kernel's IPv6 multicast functionality. The vulnerability was discovered in February 2025 and involves a potential Use-After-Free (UAF) issue in the igmp6_send() function. The vulnerability occurs because igmp6_send() can be called without RTNL or RCU being held, which could lead to unsafe network pointer fetching (Kernel Git).

The vulnerability exists in the igmp6_send() function within the IPv6 multicast implementation. The issue stems from insufficient RCU (Read-Copy-Update) protection when accessing network namespace pointers. The function previously used sock_alloc_send_skb() which was problematic because ipv6.igmp_sk uses GFP_KERNEL allocations that can sleep. The fix involves extending RCU protection and using alloc_skb() instead, while charging the net->ipv6.igmp_sk socket under RCU protection (Kernel Git). The vulnerability has been assigned a CVSS v3.1 score of 5.5 (Medium) (Snyk).

The vulnerability could lead to a Use-After-Free condition when handling IPv6 multicast operations. This could potentially result in system crashes or memory corruption. The primary impact is on system availability, with a potential for complete loss of availability while the attack is ongoing (Snyk).

The vulnerability requires local access to exploit, with low attack complexity and low privileges required. No user interaction is needed for exploitation. The EPSS (Exploit Prediction Scoring System) indicates a relatively low probability of exploitation at 0.05% (19th percentile) (Snyk).

The vulnerability has been patched in the Linux kernel through a commit that extends RCU protection in igmp6_send(). The fix involves changing the memory allocation method from sock_alloc_send_skb() to alloc_skb() and ensuring proper RCU protection when accessing network namespace pointers (Kernel Git). For CentOS 7, there is currently no fixed version available (Snyk).