CVE-2025-021701: Linux Kernel Ethtool Netlink.c Use After Free Vulnerability
Summary
CVE-2025-021701: In ethnl_ops_begin of netlink.c, there is a possible use after free due to a race condition. Affects :linux_kernel: versions >= :0, < :2025-09-05. Fixed in :2025-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Android operating system, responsible for managing hardware resources and providing essential services to applications. It is designed for performance, security, and stability. However, like any complex software, it is susceptible to vulnerabilities. This specific issue arises in the Ethtool component, which is used for network interface configuration, highlighting the kernel's exposure to potential security risks.
Vulnerability Detail
In the ethnl_ops_begin function of netlink.c, there exists a use after free vulnerability due to a race condition. This flaw allows an attacker to exploit the vulnerability to escalate privileges locally without requiring additional execution privileges. The risk is significant as it could lead to unauthorized access to sensitive system resources, potentially compromising the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
:2025-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2025-021701 vulnerability poses a significant risk to the Linux Kernel's Ethtool component, allowing for potential privilege escalation. It is essential to apply the available patches promptly to safeguard against exploitation. Regular monitoring and updates are crucial for maintaining system security.
See every vulnerability recorded for :linux_kernel: →
FAQ
CVE-2025-021701 is a vulnerability in the Linux Kernel's Ethtool component that allows for a use after free condition, potentially leading to local privilege escalation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could allow an attacker to gain unauthorized access to system resources, compromising the security of the system.
Yes, patches are available in specific commits on the Android source repository. Ensure to update to the version released on or after September 5, 2025.
Vulert is a monitoring tool that uses the gradle.lockfile to track and alert users about open-source vulnerabilities in their software in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
