Security readout for executives and security teams
Plain-English summary
CVE-2025-21662 is a Linux kernel mlx5 driver flaw where an error path can leave a command waiting forever. In practical terms, affected systems may experience hung kernel worker tasks and degraded network device behavior. The public sources do not provide CVSS, exploitability, or a clear attacker model.
Executive priority
Prioritize patching on infrastructure that depends on mlx5 networking, especially production hosts where a kernel task hang could affect service availability. There is no source-backed evidence of active exploitation, so urgency should be operational-risk driven rather than incident-response driven.
Technical view
In net/mlx5, cmd_work_handler() returned early after cmd_alloc_index() failure without completing ent->slotted. Callers waiting in cmd_exec() could remain blocked, producing hung task reports. The kernel stable references are fixes for this completion handling issue across maintained branches.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with mlx5 driver usage. The bundle lists affected Linux versions including 6.10, 6.1.125, 6.6.72, 6.12.10, and 6.13, but product-specific distro mappings require vendor confirmation.
Exploitation context
No active exploitation is supported by the provided sources. The CVE is not marked KEV, and the bundle does not describe exploit code, remote reachability, privilege requirements, or public weaponization. Treat this primarily as an availability risk until vendor advisories clarify impact.
Researcher notes
The source evidence supports a missed completion on an mlx5 command error path causing waits to hang. Missing data includes CVSS, attacker prerequisites, remote/local triggerability, and distro-specific affected package ranges. Avoid assuming exploitability beyond the documented availability failure mode.
Mitigation direction
- Apply kernel or distro updates that include the referenced stable fixes.
- Check Linux vendor advisories for affected package versions and backports.
- Prioritize systems using mlx5 network devices or modules.
- Plan maintenance windows for kernel upgrades where reboot is required.
- Monitor vendor guidance if running custom or long-term kernels.
Validation and detection
- Inventory kernel versions against vendor advisories and the CVE record.
- Confirm whether mlx5 drivers are present and used on critical hosts.
- Review kernel logs for cmd_work_handler allocation failures or hung task reports.
- Verify updated kernels include the relevant stable fix commits.
- Confirm post-update stability on hosts using mlx5 networking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21662 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f0a2808767ac39f64b1d9a0ff865c255073cf3d4CVE reference, Linux
- https://git.kernel.org/stable/c/229cc10284373fbe754e623b7033dca7e7470ec8CVE reference, Linux
- https://git.kernel.org/stable/c/36124081f6ffd9dfaad48830bdf106bb82a9457dCVE reference, Linux
- https://git.kernel.org/stable/c/0e2909c6bec9048f49d0c8e16887c63b50b14647CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.