Security readout for executives and security teams
Plain-English summary
A Linux PFCP networking bug can leave a device tied to the wrong network namespace. Deleting that namespace may trigger unsafe kernel cleanup and potentially affect confidentiality, integrity, or availability. Exploitation requires local access and specific PFCP and namespace conditions; the supplied evidence does not show remote or active exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue on exposed multi-tenant, container, or PFCP-enabled systems. Patch through normal emergency or accelerated maintenance based on local-access controls and feature usage. Broad internet-facing emergency action is not supported because the evidence indicates local exploitation conditions and no active exploitation.
Technical view
pfcp_newlink() registered the PFCP device under the device namespace while creating its UDP tunnel socket in another namespace. Removing the socket namespace could leave a live device referencing the dismantled namespace, causing a reference-tracker warning during cleanup. The kernel fix aligns device lifetime with the socket namespace and removes PFCP devices during namespace exit.
Likely exposure
Exposure is limited to systems running affected Linux versions where PFCP devices and multiple network namespaces are used or can be created. Container hosts, telecommunications workloads, and test systems may warrant closer review. The bundle lists affected releases including 6.10, 6.12.11, and 6.13, but does not provide complete distribution package mappings.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. However, the supplied evidence demonstrates a kernel cleanup warning, not a working security exploit. The record is not in KEV, and no cited source establishes active exploitation, public weaponization, or remote reachability.
Researcher notes
The key defect is inconsistent ownership between dev_net(dev) and the namespace holding the UDP tunnel socket. Validation should focus on lifetime handling when namespaces differ and during teardown. The bundle provides fix commits but no CWE, exploit proof, complete affected-version ranges, or distribution-specific status; avoid extrapolating beyond vendor backports.
Mitigation direction
- Install a vendor kernel containing either referenced stable fix or its documented backport.
- Prioritize systems using PFCP devices, network namespaces, containers, or telecommunications networking.
- Where patching is delayed, restrict local access and privileges used to administer network namespaces.
- Check distribution security advisories for exact package versions and reboot requirements.
Validation and detection
- Inventory kernel and distribution package versions across Linux hosts.
- Determine whether PFCP support is present, loaded, or used in production workloads.
- Compare installed kernel packages with vendor advisories and referenced stable commits.
- Review kernel logs for PFCP-related namespace cleanup warnings or reference-tracker messages.
- Confirm updated systems booted into the patched kernel after maintenance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21677 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1c35a66e2bfea53dea3562b2575ac7fd4c38ee61CVE reference, Linux
- https://git.kernel.org/stable/c/ffc90e9ca61b0f619326a1417ff32efd6cc71ed2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.