CVE-2025-21751

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21751", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.759Z", "datePublished": "2025-02-27T02:12:22.177Z", "dateUpdated": "2026-08-05T11:54:07.723Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:07.723Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, change error flow on matcher disconnect\n\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\n\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\n\nNote that we're dealing here with FW error. We can't overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\n\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `hws_matcher_disconnect()` is only reached from mlx5 control-plane operations \u2014 BWC matcher teardown and rehash driven by eswitch/TC-flower/conntrack hardware-offload configuration via netlink \u2014 not from received network packets. This matches the AV:L scoring of all sibling mlx5 HWS CVEs.\nAC:L - The freed-matcher-on-list condition only arises when a `MODIFY_FLOW_TABLE` firmware command fails mid-disconnect; however, an attacker able to drive matcher create/destroy churn can retry the operation indefinitely, and once the leak occurs the dangling list entry is deterministically dereferenced by the next connect/disconnect/debugfs walk, so exploitation is not gated on a race or on unknowable memory layout.\nPR:L - Reaching the matcher destroy/rehash path requires the ability to add and remove offloaded steering rules (TC flower / conntrack offload) on an mlx5 device, i.e. CAP_NET_ADMIN over the relevant netdev, which is obtainable by a low-privileged actor holding a delegated network namespace or VF/SF rather than requiring real root in the init namespace.\nUI:N - No victim action is needed; the freed matcher is left on `tbl->matchers_list` and is dereferenced by the driver's own subsequent steering operations with no user involvement.\nS:U - The corruption is confined to kernel slab memory and mlx5 steering state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The stale entry is read by `list_first_entry`/`list_last_entry` in `table.c:298/408` and by the debugfs dump at `debug.c:233`, which serialises fields of the freed `struct mlx5hws_matcher` to userspace \u2014 a direct disclosure of reallocated kernel heap contents, and the UAF generally enables arbitrary read after heap grooming.\nI:H - `hws_matcher_connect()` performs `list_add`/`list_add_tail` through the dangling `list_node`, writing kernel pointers into freed memory that may already hold another object, giving a heap-corruption write primitive; stale `rtc_0_id`/`rtc_1_id` values are also programmed into hardware steering, corrupting packet-forwarding policy.\nA:H - The commit message states this \"leads to use-after-free and eventual crash\"; dereferencing the freed matcher reliably produces an oops/panic, and the resulting steering-state corruption also breaks packet forwarding on the NIC."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"], "versions": [{"version": "472dd792348f6601ccaa97d5626ee4faff891901", "lessThan": "5682aad0276ff9b9b0eff3188eb6a1f504d6b436", "status": "affected", "versionType": "git"}, {"version": "472dd792348f6601ccaa97d5626ee4faff891901", "lessThan": "23a86c76a1a197e8fbbbd0ce3e826eb58c471624", "status": "affected", "versionType": "git"}, {"version": "472dd792348f6601ccaa97d5626ee4faff891901", "lessThan": "1ce840c7a659aa53a31ef49f0271b4fd0dc10296", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.48", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.3", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.48"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.13.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436"}, {"url": "https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624"}, {"url": "https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296"}], "title": "net/mlx5: HWS, change error flow on matcher disconnect", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21751", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-27T18:14:26.697302Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T18:22:29.728Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21751", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-27T18:14:26.697302Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T18:14:27.891Z"}}], "cna": {"title": "net/mlx5: HWS, change error flow on matcher disconnect", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `hws_matcher_disconnect()` is only reached from mlx5 control-plane operations \u2014 BWC matcher teardown and rehash driven by eswitch/TC-flower/conntrack hardware-offload configuration via netlink \u2014 not from received network packets. This matches the AV:L scoring of all sibling mlx5 HWS CVEs.\nAC:L - The freed-matcher-on-list condition only arises when a `MODIFY_FLOW_TABLE` firmware command fails mid-disconnect; however, an attacker able to drive matcher create/destroy churn can retry the operation indefinitely, and once the leak occurs the dangling list entry is deterministically dereferenced by the next connect/disconnect/debugfs walk, so exploitation is not gated on a race or on unknowable memory layout.\nPR:L - Reaching the matcher destroy/rehash path requires the ability to add and remove offloaded steering rules (TC flower / conntrack offload) on an mlx5 device, i.e. CAP_NET_ADMIN over the relevant netdev, which is obtainable by a low-privileged actor holding a delegated network namespace or VF/SF rather than requiring real root in the init namespace.\nUI:N - No victim action is needed; the freed matcher is left on `tbl->matchers_list` and is dereferenced by the driver's own subsequent steering operations with no user involvement.\nS:U - The corruption is confined to kernel slab memory and mlx5 steering state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The stale entry is read by `list_first_entry`/`list_last_entry` in `table.c:298/408` and by the debugfs dump at `debug.c:233`, which serialises fields of the freed `struct mlx5hws_matcher` to userspace \u2014 a direct disclosure of reallocated kernel heap contents, and the UAF generally enables arbitrary read after heap grooming.\nI:H - `hws_matcher_connect()` performs `list_add`/`list_add_tail` through the dangling `list_node`, writing kernel pointers into freed memory that may already hold another object, giving a heap-corruption write primitive; stale `rtc_0_id`/`rtc_1_id` values are also programmed into hardware steering, corrupting packet-forwarding policy.\nA:H - The commit message states this \"leads to use-after-free and eventual crash\"; dereferencing the freed matcher reliably produces an oops/panic, and the resulting steering-state corruption also breaks packet forwarding on the NIC."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "472dd792348f6601ccaa97d5626ee4faff891901", "lessThan": "5682aad0276ff9b9b0eff3188eb6a1f504d6b436", "versionType": "git"}, {"status": "affected", "version": "472dd792348f6601ccaa97d5626ee4faff891901", "lessThan": "23a86c76a1a197e8fbbbd0ce3e826eb58c471624", "versionType": "git"}, {"status": "affected", "version": "472dd792348f6601ccaa97d5626ee4faff891901", "lessThan": "1ce840c7a659aa53a31ef49f0271b4fd0dc10296", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.48", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.3", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436"}, {"url": "https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624"}, {"url": "https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, change error flow on matcher disconnect\n\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\n\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\n\nNote that we're dealing here with FW error. We can't overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\n\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.48", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.3", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:07.723Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21751", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:54:07.723Z", "dateReserved": "2024-12-29T08:45:45.759Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-02-27T02:12:22.177Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5682aad0276ff9b9b0eff3188eb6a1f504d6b436", "status": "affected", "version": "472dd792348f6601ccaa97d5626ee4faff891901", "versionType": "git"}, {"lessThan": "23a86c76a1a197e8fbbbd0ce3e826eb58c471624", "status": "affected", "version": "472dd792348f6601ccaa97d5626ee4faff891901", "versionType": "git"}, {"lessThan": "1ce840c7a659aa53a31ef49f0271b4fd0dc10296", "status": "affected", "version": "472dd792348f6601ccaa97d5626ee4faff891901", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.48", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE4E9494-C003-4567-B9CB-CF0C8429C517", "versionEndExcluding": "6.13.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, change error flow on matcher disconnect\n\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\n\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\n\nNote that we're dealing here with FW error. We can't overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\n\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: HWS, cambiar el flujo de error en la desconexi\u00f3n del comparador Actualmente, cuando ocurre una falla de firmware durante el flujo de desconexi\u00f3n del comparador, el flujo de error de la funci\u00f3n vuelve a conectar el comparador y devuelve un error, que contin\u00faa ejecutando la funci\u00f3n de llamada y finalmente libera el comparador que se est\u00e1 desconectando. Esto lleva a un caso en el que tenemos un comparador liberado en la lista de comparadores, lo que a su vez lleva a un use after free y un eventual bloqueo. Este parche lo corrige al no intentar volver a conectar el comparador cuando alg\u00fan comando de FW falla durante la desconexi\u00f3n. Tenga en cuenta que aqu\u00ed estamos tratando con un error de FW. No podemos superar este problema. Esto puede llevar a un mal estado de direcci\u00f3n (por ejemplo, conexi\u00f3n incorrecta entre comparadores) y tambi\u00e9n conducir\u00e1 a una fuga de recursos, como es el caso con cualquier otro manejo de errores durante la destrucci\u00f3n de recursos. Sin embargo, el objetivo aqu\u00ed es permitir que el controlador contin\u00fae y no bloquee la m\u00e1quina con un error de use after free."}], "id": "CVE-2025-21751", "lastModified": "2026-06-17T08:44:11.290", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21751", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-02-27T18:14:26.697302Z", "version": "2.0.3"}}]}, "published": "2025-02-27T03:15:15.760", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net/mlx5: HWS, change error flow on matcher disconnect", "id": "2348646", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348646"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/mlx5: HWS, change error flow on matcher disconnect\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\nNote that we're dealing here with FW error. We can't overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error."], "name": "CVE-2025-21751", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21751\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21751\nhttps://lore.kernel.org/linux-cve-announce/2025022601-CVE-2025-21751-101c@gregkh/T"], "threat_severity": "Moderate"}

{}