7.8

CVE-2025-21715: linux Use After Free

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2025-21715DEBIAN-CVE-2025-21715
Published 27-02-2025Last modified 23-05-2026
Open JSON

Vulnerability summary

CVE-2025-21715 is a high (CVSS 7.8) Use After Free vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.4% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 60 · Related 58
DLA-4102-1DLA-4178-1LSN-0117-1SUSE-SU-2025:01919-1SUSE-SU-2025:0847-1SUSE-SU-2025:0856-1

Timeline

  1. 27-02-2025
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it cannot be used after free_netdev() call. Using dm after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function. This is similar to the issue fixed in commit ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove"). This bug is detected by our static analysis tool.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu136 products
  • linux< 4.4.0-276.310 | < 4.15.0-245.257 | < 5.4.0-216.236 | < 5.15.0-140.150 | < 6.8.0-64.67
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1150.156 | < 4.4.0-1188.203 | < 4.15.0-1187.200 | < 5.4.0-1146.156 | < 5.15.0-1084.91 | < 6.8.0-1032.34
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ d28e783c20033b90a64d4e1307bafb56085d8184, < db79e982c5f9e39ab710cbce55b05f2f5e6f1ca9 | ≥ 4fd0654b8f2129b68203974ddee15f804ec011c2, < a53cb72043443ac787ec0b5fa17bb3f8ff3d462b | ≥ cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b, < 7d7d201eb3b766abe590ac0dda7a508b7db3e357 | ≥ cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b, < c94ab07edc2843e2f3d46dbd82e5c681503aaadf | ≥ cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b, < c411f9a5fdc9158e8f7c57eac961d3df3eb4d8ca | ≥ cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b, < 5a54367a7c2378c65aaa4d3cfd952f26adef7aa7 | ≥ cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b, < 2013c95df6752d9c88221d0f0f37b6f197969390 | ≥ cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b, < 19e65c45a1507a1a2926649d2db3583ed9d55fd9 | d182994b2b6e23778b146a230efac8f1d77a3445 | 427b3fc3d5244fef9c1f910a9c699f2690642f83 | 9c49181c201d434186ca6b1a7b52e29f4169f6f8 | 9808f032c4d971cbf2b01411a0a2a8ee0040efe3 | a1f308089257616cdb91b4334c5eaa81ae17e387 | ≥ 5.4.106, < 5.4.291 | ≥ 5.10.24, < 5.10.235 | ≥ 4.4.262, < 4.5 | ≥ 4.9.262, < 4.10 | ≥ 4.14.226, < 4.15 | ≥ 4.19.181, < 4.20 | ≥ 5.11.7, < 5.12 | 5.12
  • linux_kernel≥ 4.4.262, < 4.5 | ≥ 4.9.262, < 4.10 | ≥ 4.14.226, < 4.15 | ≥ 4.19.181, < 4.20 | ≥ 5.4.106, < 5.4.291 | ≥ 5.10.24, < 5.10.235 | ≥ 5.11.7, < 5.15.179 | ≥ 5.16, < 6.1.129 | ≥ 6.2, < 6.6.76 | ≥ 6.7, < 6.12.13 | ≥ 6.13, < 6.13.2
Debian1 product
  • linux< 6.1.129-1 | < 6.12.13-1

3 vendors · 139 products

References

64 links
Show all 64 references