Use After Free Vulnerability in Linux Kernel's Proc Filesystem

CVE-2025-21999

Summary

A Use After Free vulnerability exists in the Linux kernel's proc filesystem, specifically within the proc_get_inode() function. This flaw arises from a race condition between the removal of a module and the instantiation of inodes linked to /proc entries. When accessing module operations post-removal, the kernel can dereference freed memory, potentially leading to system instability and unexpected behavior. The vulnerability could be exploited if an attacker can trigger the module removal while a lookup operation is conducted on a /proc entry, causing significant security concerns.

References