Search/CVE-2025-21823
● CVE — High

CVE-2025-21823

VendorlinuxProductlinux kernelDiscoveredFeb 27, 2025UpdatedJul 30, 2026

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Drop unmanaged ELP metric worker The ELP worker needs to calculate new metric values for all neighbors "reachable" over an interface. Some of the used metric sources require locks which might need to sleep. This sleep is incompatible with the RCU list iterator used for the recorded neighbors. The initial approach to work around of this problem was to queue another work item per neighbor and then run this in a new context. Even when this solved the RCU vs might_sleep() conflict, it has a major problems: Nothing was stopping the work item in case it is not needed anymore - for example because one of the related interfaces was removed or the batman-adv module was unloaded - resulting in potential invalid memory…

CVSS v3.1
7.8 HIGH
EPSS
0.24%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
3
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 22, 2026
▲ 0.03pp
0.21% → 0.24% over 5 tracked changes
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Connections
4 relationships
Timeline
disclosure → media coverage
Feb 27, 2025
Disclosure — published as a CVE record. · last revised by NVD Jul 30, 2026
Aug 19, 2025
ubuntu.com reports: USN-7703-1: Linux kernel vulnerabilities
Aug 20, 2025
ubuntu.com reports: USN-7703-2: Linux kernel vulnerabilities
Aug 26, 2025
ubuntu.com reports: USN-7719-1: Linux kernel (Raspberry Pi Real-time) vulnerabilities