CVE-2025-21761: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21761 affects the Linux kernel's openvswitch component, specifically the ovsvportcmdfillinfo() function. The vulnerability was discovered on February 26, 2025, and involves a potential Use-After-Free (UAF) condition that occurs when the function is called without proper RCU (Read-Copy-Update) protection (NVD).

The vulnerability exists in the ovsvportcmdfillinfo() function within the Linux kernel's openvswitch module. The issue arises because the function can be called without RTNL or RCU protection, potentially leading to a Use-After-Free condition. The CVSS v3.1 base score is 7.8 (HIGH), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially lead to a Use-After-Free condition, which might result in system crashes, memory corruption, or potential privilege escalation. The high CVSS score indicates significant potential impact on system confidentiality, integrity, and availability (NVD).

A patch has been developed that implements RCU protection and uses devnetrcu() to prevent the potential UAF condition. The fix involves modifying the ovsvportcmdfillinfo() function to properly handle network namespace access under RCU protection (Kernel Patch).