CVE-2025-21999

Summary

CVE-2025-21999 is a vulnerability in the Linux kernel that affects the proc subsystem. The issue lies in the proc_get_inode() function where a use-after-free (UAF) condition can occur due to a race condition between the rmmod command and the instantiation of a process's inode. This race condition results from the fact that pde->proc_ops, which should belong to /proc, instead belongs to a module. To mitigate this issue, the recommended solution is to save necessary information for inode instantation before proc_register() in the PDE itself, avoiding the need to dereference pde->proc_ops. Failure to do so can result in a UAF, as demonstrated in the provided call trace and crash log.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.