Security readout for executives and security teams
Plain-English summary
A Linux network driver can access hardware memory outside the intended region when a device uses more than 1,024 queue pairs. The documented result is a kernel paging fault, which can crash or destabilize affected systems. Exposure requires the hns3/hclge driver, relevant hardware configuration, and an affected kernel build.
Executive priority
Treat this as a high-priority infrastructure patch where the affected driver and large queue configuration are present. Broad emergency action is not supported for systems lacking that hardware path. Ask platform teams to identify exposed hosts, confirm vendor-fixed kernels, and monitor for the documented kernel fault signature.
Technical view
The hclge_fetch_pf_reg function failed to account for two TQP BAR address segments. For TQP counts above 1,024, register retrieval could access outside the correct BAR space. The correction reads queues through the already segmented tqp.io_base address. The supplied CVSS is 7.8: local access, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Likely exposure is limited to Linux systems using the hns3/hclge network driver with more than 1,024 TQPs. This is not presented as remotely exploitable. The bundled version representation is ambiguous, so administrators should confirm exact kernel builds and vendor backports against the CVE record rather than relying solely on version strings.
Exploitation context
The CVE is not listed in KEV, and the supplied sources do not report active exploitation or a public exploit. The CVSS vector describes a local, low-complexity path requiring low privileges. The documented trigger path involves retrieving device registers through ethtool and results in a kernel paging fault; stronger exploitation outcomes are not demonstrated.
Researcher notes
The evidence clearly identifies an out-of-bounds BAR access caused by incorrect TQP segment handling. The supplied trace demonstrates a kernel paging fault. Although the CVSS assigns high impact across confidentiality, integrity, and availability, the bundle does not demonstrate exploitation beyond the fault. Exact affected-version boundaries should be verified from the authoritative record and commit ancestry.
Mitigation direction
- Update to a vendor kernel incorporating the referenced hns3 stable fix.
- Check distribution guidance for build-specific backports and remediation status.
- Prioritize systems using hns3/hclge with configurations exceeding 1,024 TQPs.
- Limit unnecessary local access while affected systems await remediation.
Validation and detection
- Inventory kernel builds and systems loading the hns3 or hclge modules.
- Determine whether applicable network devices expose more than 1,024 TQPs.
- Verify the installed kernel includes a referenced fix or vendor-equivalent backport.
- Review kernel logs for paging faults containing hclge_fetch_pf_reg or hclge_get_regs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21650 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0575baa733fc4219f230aef22d5bc35d922f1e9aCVE reference, Linux
- https://git.kernel.org/stable/c/7997ddd46c54408bcba5e37fe18b4d832e45d4d4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.