Security readout for executives and security teams
Plain-English summary
A Linux SMB client race can free hostname memory twice while a CIFS connection is shutting down and reconnecting across DFS targets. This can corrupt kernel memory and crash the system. The supplied record rates it critical, but the evidence does not establish remote code execution or real-world attacks.
Executive priority
Treat as an urgent kernel-maintenance issue for Linux systems using SMB/CIFS with DFS. Patch those systems first, then validate broader fleet exposure. Avoid assuming every Linux host is immediately exploitable: the documented failure requires a particular reconnect-and-shutdown race, and exploitation evidence is absent.
Technical view
CVE-2025-21673 is a CWE-415 double free in the Linux CIFS client. cifs_put_tcp_session() could release TCP_Server_Info::hostname before the cifsd thread finished reconnecting to multiple DFS targets. A subsequent reconnect could reuse or free that memory, producing kernel memory corruption and a slab-free fault.
Likely exposure
Exposure is most likely on affected Linux kernels actively using the CIFS/SMB client with DFS targets, particularly during concurrent session shutdown and reconnection. The supplied version data is not a clear contiguous range, so organizations should map their distribution kernel package to vendor guidance and the referenced stable fixes.
Exploitation context
The bundle reports no known active exploitation, and the CVE is not listed as KEV. The demonstrated outcome is a kernel fault during a specific CIFS DFS reconnection race. Although the supplied CVSS is 9.8, the sources provided do not demonstrate remote code execution, data theft, or reliable attacker control.
Researcher notes
The affected-version entries contain commit identifiers, isolated releases, and an ambiguous “0,” preventing a dependable range interpretation. The trace supports a double free in CIFS DFS reconnection and a kernel crash. Further conclusions about attacker reachability, exploitation primitives, or confidentiality and integrity impact are not established by the supplied sources.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable referenced stable fix.
- Check Linux distribution advisories for package-specific affected and fixed versions.
- Prioritize systems using CIFS mounts and DFS namespaces.
- Follow vendor guidance if an updated kernel is not immediately available.
Validation and detection
- Record each system's running kernel and distribution package version.
- Identify hosts with the CIFS module loaded or active SMB mounts.
- Determine whether mounted SMB resources use DFS targets.
- Map deployed packages against vendor advisories and referenced stable commits.
- After updating, confirm the fixed kernel is running following reboot.
- Review kernel logs for CIFS reconnect and slab-free fault signatures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21673 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1ea68070338518a1d31ce71e6abfe1b30001b27aCVE reference, Linux
- https://git.kernel.org/stable/c/a2be5f2ba34d0c6d5ef2624b24e3d852561fcd6aCVE reference, Linux
- https://git.kernel.org/stable/c/fa2f9906a7b333ba757a7dbae0713d8a5396186eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Double Free
Double Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.