Security readout for executives and security teams
Plain-English summary
CVE-2025-21636 is a Linux kernel bug that can crash the system when SCTP sysctl handling reads network namespace state from the current task during edge-case task exit conditions. The business impact is availability: a local low-privileged actor could cause a denial of service on affected kernels.
Executive priority
Patch during the next normal kernel maintenance cycle, faster for shared or multi-tenant systems. This is a credible availability bug, but sources do not show remote exploitation, data theft, privilege escalation, or active exploitation.
Technical view
The flaw is a CWE-476 null pointer dereference in SCTP plpmtud_probe_interval sysctl handling. Kernel code used current->nsproxy to find the net namespace, which can be NULL in some cases. The fix obtains the net structure from table->data instead. CVSS is 5.5: local, low complexity, low privileges, availability impact only.
Likely exposure
Exposure is limited to Linux systems running affected kernel builds. Risk is most relevant where untrusted local users, hosted workloads, or containerized processes can reach the vulnerable kernel path. The provided sources do not identify a remote attack path.
Exploitation context
The CVE is not marked KEV, and the provided sources do not report active exploitation. The issue was found by syzbot under a task-exit edge case. Treat it as a local denial-of-service risk, not a confidentiality or integrity compromise based on available evidence.
Researcher notes
Focus validation on affected Linux kernel branches and whether the SCTP sysctl fix is present. The root issue is namespace lookup through current->nsproxy during sysctl access. Evidence supports local denial of service only; do not infer remote reachability without vendor-specific proof.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- Prioritize multi-user servers, shared hosting, and container hosts.
- Check Linux distribution advisories for exact package versions.
- Use standard change windows if availability risk is manageable.
- Avoid direct wrangler or deployment assumptions; this is kernel remediation.
Validation and detection
- Inventory Linux kernel versions across servers and appliances.
- Compare installed kernels with vendor advisories and fixed stable commits.
- Confirm distribution packages include the CVE-2025-21636 fix.
- Review whether untrusted local workloads run on affected hosts.
- After patching, verify hosts boot into the updated kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21636 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1dc5da6c4178f3e4b95c631418f72de9f86c0449CVE reference, Linux
- https://git.kernel.org/stable/c/44ee8635922b6eb940faddb961a8347c6857d722CVE reference, Linux
- https://git.kernel.org/stable/c/284a221f8fa503628432c7bb5108277c688c6ffaCVE reference, Linux
- https://git.kernel.org/stable/c/bcf8c60074e81ed2ac2d35130917175a3949c917CVE reference, Linux
- https://git.kernel.org/stable/c/6259d2484d0ceff42245d1f09cc8cb6ee72d847aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.