Security readout for executives and security teams
Plain-English summary
A race in the Linux kernel’s ROSE networking timers can access memory after it has been freed. A local, low-privileged user may be able to trigger serious confidentiality, integrity, or availability impact. Exposure depends on the installed kernel and whether ROSE networking is present and accessible.
Executive priority
Treat this as a high-priority kernel maintenance issue on multi-user or locally accessible Linux systems. Patch through supported vendor channels promptly, while validating actual exposure before emergency disruption. Internet exposure alone does not establish exploitability because the supplied vector requires local access.
Technical view
ROSE timer callbacks lock the socket but previously did not check whether a user thread owned it. Concurrent timer and user-thread activity can cause a slab use-after-free in rose_timer_expiry. The supplied CVSS 3.1 score is 7.8: local, low-complexity, low-privilege, no user interaction, with potentially high impact.
Likely exposure
Potentially exposed assets are Linux systems running the affected kernel versions or lines identified in the CVE data, particularly multi-user systems where low-privileged local users can reach ROSE functionality. The bundle does not establish that every distribution kernel with a matching version is vulnerable; vendor backports may change status.
Exploitation context
The supplied record is not marked as KEV, and the sources provide no evidence of active exploitation. The demonstrated failure came from syzkaller with KASAN and produced a kernel use-after-free. CVSS characterizes exploitation as local with low privileges; remote exploitability is not supported by the bundle.
Researcher notes
The evidence confirms a timer-versus-user-thread race and KASAN-detected slab use-after-free at rose_timer_expiry. Multiple stable commits indicate fixes across kernel branches. The bundle provides neither a CWE assignment nor evidence of public or active exploitation. Distribution package status should take precedence over simple upstream version matching because fixes may be backported.
Mitigation direction
- Install the distribution or vendor kernel update incorporating the applicable Linux stable fix.
- Reboot affected systems into the updated kernel and confirm the running version changed.
- Prioritize shared or multi-user hosts where untrusted local accounts exist.
- If updates are unavailable, obtain product-specific mitigation guidance from the Linux distributor or appliance vendor.
Validation and detection
- Inventory running kernel versions across Linux servers, endpoints, appliances, and embedded systems.
- Confirm whether ROSE networking is present and accessible on each potentially affected host.
- Compare vendor package status with the CVE record and applicable stable-kernel fix.
- Verify the patched kernel is running after reboot, not merely installed.
- Review kernel crash telemetry for rose_timer_expiry or slab-use-after-free indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21718 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/52f5aff33ca73b2c2fa93f40a3de308012e63cf4CVE reference, Linux
- https://git.kernel.org/stable/c/0d5bca3be27bfcf8f980f2fed49b6cbb7dafe4a1CVE reference, Linux
- https://git.kernel.org/stable/c/1409b45d4690308c502c6caf22f01c3c205b4717CVE reference, Linux
- https://git.kernel.org/stable/c/f55c88e3ca5939a6a8a329024aed8f3d98eea8e4CVE reference, Linux
- https://git.kernel.org/stable/c/51c128ba038cf1b79d605cbee325919b45ab95a5CVE reference, Linux
- https://git.kernel.org/stable/c/1992fb261c90e9827cf5dc3115d89bb0853252c9CVE reference, Linux
- https://git.kernel.org/stable/c/58051a284ac18a3bb815aac6289a679903ddcc3fCVE reference, Linux
- https://git.kernel.org/stable/c/5de7665e0a0746b5ad7943554b34db8f8614a196CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.