Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can make crashdump collection hang during kdump on memory-constrained systems. It is mainly an availability and incident-response reliability problem: after a crash, the system may fail to complete vmcore reading, delaying root-cause analysis.
Executive priority
Treat as a moderate operational resilience issue. Prioritize systems where crash forensics, uptime recovery, or regulated incident response depends on reliable kdump output.
Technical view
The flaw is in fs/proc __read_vmcore. During vmcore reads at kdump time, the second loop may not reschedule often enough, causing softlockups. The upstream fix adds cond_resched() to reduce hangs. CVSS is 5.5 with local, low-complexity, low-privilege availability impact.
Likely exposure
Exposure is most relevant to Linux systems using kdump or vmcore collection, especially memory-constrained crash kernels. The bundle also includes Debian LTS and Siemens advisories, indicating downstream product exposure may depend on vendor kernel packaging.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. The CVSS vector is local and low-privilege, with no confidentiality or integrity impact. Evidence supports denial-of-service or crashdump disruption, not remote compromise.
Researcher notes
The available evidence describes a scheduler fairness fix in __read_vmcore, not a memory corruption or privilege escalation flaw. Affected-version interpretation should be validated against vendor kernel advisories because Linux CVE records often map commits across multiple stable branches.
Mitigation direction
- Apply the relevant vendor kernel update for affected Linux branches.
- Review Debian LTS and Siemens advisories if those products are in scope.
- Use kernel stable commits as branch-specific fix references.
- If patching is delayed, check vendor guidance for supported temporary measures.
Validation and detection
- Inventory Linux kernel versions across kdump-enabled systems.
- Confirm whether crash kernels collect vmcore through /proc/vmcore.
- Map installed kernels to vendor advisories or listed stable commits.
- After updating, test crashdump collection in a controlled environment.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 84c4ed156265
- Linux stable commit 80da29deb88a
- Linux stable commit 649b266606bc
- Linux stable commit 65c367bd9d4f
- Linux stable commit a5a2ee8144c3
- Linux stable commit 80828540dad0
- Linux stable commit cbc5dde0a461
- Debian LTS announcement 2025-03-01
- Debian LTS announcement 2025-03-02
- Siemens SSA-398330
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21694 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/84c4ed15626574c9ac6c1039ba9c137a77bcc7f2CVE reference, Linux
- https://git.kernel.org/stable/c/80da29deb88a3a907441fc35bb7bac309f31e713CVE reference, Linux
- https://git.kernel.org/stable/c/649b266606bc413407ce315f710c8ce8a88ee30aCVE reference, Linux
- https://git.kernel.org/stable/c/65c367bd9d4f43513c7f837df5753bea9561b836CVE reference, Linux
- https://git.kernel.org/stable/c/a5a2ee8144c3897d37403a69118c3e3dc5713958CVE reference, Linux
- https://git.kernel.org/stable/c/80828540dad0757b6337c6561d49c81038f38d87CVE reference, Linux
- https://git.kernel.org/stable/c/cbc5dde0a461240046e8a41c43d7c3b76d5db952CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-355557.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.