Security readout for executives and security teams
Plain-English summary
CVE-2025-21683 is a Linux kernel memory leak in BPF reuseport socket selection. A local user could potentially trigger resource exhaustion, affecting system availability, but the sources do not indicate data theft or remote compromise.
Executive priority
Treat as a moderate Linux availability risk. Patch through normal kernel maintenance, with higher urgency for shared infrastructure where local users or workloads could stress kernel memory.
Technical view
The bug is in bpf_sk_select_reuseport(), where sockmap lookup can return an established TCP socket with sk_reuseport_cb set. Error paths failed to drop the socket reference, creating a CWE-401 memory leak. CVSS is 5.5, local, low privilege, availability impact only.
Likely exposure
Exposure is mainly Linux systems running affected kernel versions or vendor distributions carrying the vulnerable code. Internet-facing status alone is not the key factor because the CVSS vector is local with privileges required.
Exploitation context
No provided source reports active exploitation, and the CVE is not in KEV. The documented impact is local availability degradation through memory leakage, not confidentiality or integrity compromise.
Researcher notes
Evidence supports a kernel reference leak in BPF reuseport handling. The source bundle provides fix commits and advisories, but not proof-of-concept status, real-world exploitation, or detailed per-distribution affected package matrices beyond referenced advisories.
Mitigation direction
- Apply kernel updates that include the referenced stable fixes.
- Check Linux distribution advisories for backported fixes and package versions.
- For Debian LTS systems, review the linked March 2025 advisories.
- For Siemens environments, review SSA-265688 for affected product guidance.
- Prioritize shared multi-user and container-host Linux systems.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and embedded systems.
- Compare installed kernels against vendor advisories and fixed stable branches.
- Confirm updated kernels are booted, not only installed.
- Review vulnerability scanner findings for CVE-2025-21683 against distribution backport status.
- Check whether relevant Siemens products are present in the environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21683 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/bb36838dac7bb334a3f3d7eb29875593ec9473fcCVE reference, Linux
- https://git.kernel.org/stable/c/0ab52a8ca6e156a64c51b5e7456cac9a0ebfd9bfCVE reference, Linux
- https://git.kernel.org/stable/c/d0a3b3d1176d39218b8edb2a2d03164942ab9ccdCVE reference, Linux
- https://git.kernel.org/stable/c/b02e70be498b138e9c21701c2f33f4018ca7cd5eCVE reference, Linux
- https://git.kernel.org/stable/c/cccd51dd22574216e64e5d205489e634f86999f3CVE reference, Linux
- https://git.kernel.org/stable/c/b3af60928ab9129befa65e6df0310d27300942bfCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.