Security readout for executives and security teams
Plain-English summary
A Linux kernel networking defect can crash a system when an mlx5e network interface is opened from certain high-numbered CPUs. An authorized local user able to perform the relevant network configuration could cause a kernel panic, disrupting services. The supplied evidence directly demonstrates loss of availability; it does not establish real-world data theft or modification.
Executive priority
Treat as a high-priority availability risk for Linux servers using mlx5e networking, particularly large multi-CPU systems. Patch those systems promptly through supported vendor channels. Broader emergency action is not supported by the supplied evidence because exploitation is local and no active exploitation is reported.
Technical view
mlx5e_open_xdpredirect_sq passed a CPU identifier to kvzalloc_node where a NUMA node identifier was required. On systems where the CPU ID exceeds MAX_NUMNODES, an ethtool or netlink operation reaching mlx5e_open can cause out-of-bounds access and a kernel page fault. The referenced stable changes add the missing cpu_to_node conversion.
Likely exposure
Exposure requires an affected Linux kernel, an active mlx5e-related configuration, relevant CPU/NUMA conditions, and local permission to perform the triggering network operation. The bundle records affected 6.13-series information, but its version encoding is ambiguous; confirm exposure against distribution advisories and kernel package changelogs.
Exploitation context
The CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction. The bundle marks the CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The demonstrated outcome is an out-of-bounds kernel access followed by panic.
Researcher notes
The crash depends on a CPU identifier being misused as a NUMA node argument without an effective runtime check on non-DEBUG_VM builds. The trace supports a kernel page fault through mlx5e_open_channels. Although the CVSS vector assigns high confidentiality, integrity, and availability impacts, the supplied technical evidence directly demonstrates only a panic; further impacts remain unproven here.
Mitigation direction
- Install a vendor-supported kernel containing one of the referenced stable fixes.
- Check distribution guidance before selecting an exact fixed package or version.
- Restrict network-administration capabilities and privileged interface operations to trusted users.
- Prioritize exposed hosts where mlx5e interfaces and high CPU counts are present.
Validation and detection
- Inventory kernel versions and identify hosts using the mlx5e driver.
- Check package changelogs for CVE-2025-21717 or the referenced fix commits.
- Verify patched source converts the CPU identifier using cpu_to_node.
- Review kernel logs for mlx5e_open, page faults, or unexplained panics.
- Avoid deliberately triggering the fault on production systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21717 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a275db45b4161d01716559dd7557db9ea0450952CVE reference, Linux
- https://git.kernel.org/stable/c/979284535aaf12a287a2f43d9d5dfcbdc1dc4cacCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.