Use After Free Affecting kernel-debuginfo-common-ppc64le package, versions <0:6.12.0-55.17.1.el10_0


Severity

Recommended
medium

Based on CentOS security rating.

Threat Intelligence

EPSS
0.03% (7th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Use After Free vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS10-KERNELDEBUGINFOCOMMONPPC64LE-10365186
  • published17 Jun 2025
  • disclosed27 Feb 2025

Introduced: 27 Feb 2025

CVE-2025-21764  (opens in a new tab)
CWE-416  (opens in a new tab)

How to fix?

Upgrade Centos:10 kernel-debuginfo-common-ppc64le to version 0:6.12.0-55.17.1.el10_0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-debuginfo-common-ppc64le package and not the kernel-debuginfo-common-ppc64le package as distributed by Centos. See How to fix? for Centos:10 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

ndisc: use RCU protection in ndisc_alloc_skb()

ndisc_alloc_skb() can be called without RTNL or RCU being held.

Add RCU protection to avoid possible UAF.

CVSS Base Scores

version 3.1