Security readout for executives and security teams
Plain-English summary
CVE-2025-21667 is a Linux kernel availability bug. On some 32-bit systems using XFS, a write operation can hit an infinite loop in kernel filesystem code. The practical concern is service disruption or a hung workload, not data theft or privilege escalation based on the provided sources.
Executive priority
Treat this as a targeted availability risk. It is not a broad remote emergency, but affected 32-bit XFS systems running critical workloads should be updated promptly because a local trigger can cause serious service disruption.
Technical view
The bug is in Linux iomap delayed-allocation scanning. On 32-bit kernels, folio_next_index() returns unsigned long, which can truncate a 64-bit file offset to 32 bits. During XFS writes this can cause iomap_write_delalloc_scan() to loop indefinitely. CVSS is 5.5, local, low complexity, low privilege, availability-only impact.
Likely exposure
Exposure is most likely on 32-bit Linux kernels using XFS where local users or workloads can perform writes. The source bundle lists Linux kernel branches and stable commits, but distribution-specific package mapping must be checked against each vendor advisory.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. The CVSS vector indicates local access with low privileges and no user interaction. Evidence supports a denial-of-service scenario rather than remote compromise.
Researcher notes
The key condition is 64-bit offset truncation on 32-bit kernels in iomap_write_delalloc_scan(). Validate exposure through architecture, filesystem, and kernel lineage rather than product name alone. The affected-version evidence is kernel-centric and may require distribution backport review.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- Prioritize 32-bit Linux systems using XFS filesystems.
- Check Debian LTS guidance if running affected Debian kernel packages.
- If patching is delayed, reduce untrusted local write access on exposed hosts.
- Schedule reboot or kernel live-patch validation after updating.
Validation and detection
- Inventory Linux hosts for 32-bit kernels and XFS usage.
- Map installed kernel packages to vendor advisories for CVE-2025-21667.
- Confirm the running kernel includes the applicable stable fix.
- Verify updated hosts have rebooted into the fixed kernel.
- Review monitoring for filesystem write hangs or kernel availability symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-835: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21667 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7ca4bd6b754913910151acce00be093f03642725CVE reference, Linux
- https://git.kernel.org/stable/c/91371922704c8d82049ef7c2ad974d0a2cd1174dCVE reference, Linux
- https://git.kernel.org/stable/c/402ce16421477e27f30b57d6d1a6dc248fa3a4e4CVE reference, Linux
- https://git.kernel.org/stable/c/c13094b894de289514d84b8db56d1f2931a0badeCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Loop with Unreachable Exit Condition ('Infinite Loop')
Loop with Unreachable Exit Condition ('Infinite Loop') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.