Security readout for executives and security teams
Plain-English summary
CVE-2025-21658 is a Linux kernel Btrfs crash bug. A corrupted Btrfs image mounted in rescue read-only mode can trigger a NULL pointer dereference during scrub, causing a kernel crash. The main business impact is local denial of service, not data theft or remote compromise.
Executive priority
Treat as a routine-to-priority kernel availability fix for Btrfs systems. It is not supported as remotely exploitable by the provided sources, but a crash in production can still disrupt services. Patch during the next appropriate maintenance window, faster for systems handling untrusted images.
Technical view
Btrfs scrub code can dereference a NULL extent tree root when operating on a corrupted filesystem image mounted with rescue options. The reported Syzbot trace crashes in find_first_extent_item via scrub_find_fill_first_stripe. The kernel fix adds a validity check for the extent root; older kernels may require manual backporting.
Likely exposure
Exposure is most relevant to Linux systems using Btrfs, especially environments processing untrusted or corrupted filesystem images. Practical impact requires local access and conditions allowing the filesystem image to be mounted and scrubbed. Distribution backports determine whether a specific kernel build is vulnerable.
Exploitation context
The public record describes a Syzbot reproducer and kernel crash path. It does not cite active exploitation, and the CVE is not listed as KEV in the provided bundle. The CVSS vector is local, low complexity, low privilege, and high availability impact.
Researcher notes
Root cause is CWE-476 in Btrfs scrub when extent_root is NULL after mounting a corrupted image with rescue behavior. The fix path is explicit, but exact affected distro kernels require vendor mapping. Sources mention older-than-6.6 kernels may need manual backporting.
Mitigation direction
- Update to a kernel or vendor package containing the referenced Btrfs stable fixes.
- Check your Linux distribution advisory for backported fixes and affected kernel builds.
- Limit handling of untrusted Btrfs images on production systems until patched.
- Avoid unnecessary Btrfs scrub operations on corrupted rescue-mounted images.
Validation and detection
- Inventory systems using Btrfs filesystems or Btrfs image-processing workflows.
- Confirm running kernel versions against vendor advisories and stable fix commits.
- Review whether kernels include the extent-root validity check in Btrfs scrub code.
- Prioritize hosts where local users can mount or process filesystem images.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21658 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/24b85a8b0310e0144da9ab30be42e87e6476638aCVE reference, Linux
- https://git.kernel.org/stable/c/aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784CVE reference, Linux
- https://git.kernel.org/stable/c/6aecd91a5c5b68939cf4169e32bc49f3cd2dd329CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.