Security readout for executives and security teams
Plain-English summary
A Linux networking flaw can crash affected systems that forward IPv4 traffic while using hardware-accelerated IPsec/XFRM processing. The demonstrated failure is a kernel NULL-pointer dereference in the mlx5 transmit path, causing loss of availability. Ordinary Linux hosts without this forwarding and offload combination are less likely to be exposed.
Executive priority
Treat this as high priority for IPsec gateways and forwarding infrastructure using hardware offload because a kernel panic can interrupt network services. Patch those systems promptly through normal change control. Lower priority is reasonable for hosts where the required forwarding and offload conditions are confirmed absent.
Technical view
Hardware-processed packets retain an intermediate secpath entry indicating prior XFRM handling. With IPv4 forwarding enabled, that entry may persist and the packet can reenter the driver transmit path with xfrm_offload set. The documented mlx5 path then reaches a NULL instruction pointer and panics. The cited stable kernel commits remove the unnecessary intermediate secpath entry.
Likely exposure
Likely exposure is concentrated in Linux routers, gateways, or appliances combining IPv4 forwarding with XFRM/IPsec hardware offload. mlx5 is the demonstrated driver path. The supplied version data is ambiguous and does not establish clean package-level ranges, so distributions should map their kernels against the cited fixes.
Exploitation context
The CVSS 3.1 assessment is 7.5 and describes network-accessible, unauthenticated availability impact. However, this CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. They document a reproducible kernel panic under specific networking conditions.
Researcher notes
The source demonstrates an availability failure, not confidentiality or integrity impact. mlx5 appears in the supplied trace, but the evidence does not prove exclusivity to mlx5 or every offload driver. Exact affected and fixed distribution releases require vendor confirmation because the supplied version list lacks clear interval semantics.
Mitigation direction
- Install a vendor-supported kernel containing the applicable cited stable fix.
- Consult distribution guidance to map packaged kernel versions to the upstream fixes.
- Prioritize forwarding gateways and appliances using XFRM/IPsec hardware offload.
- Ensure systems reboot into the corrected kernel after package installation.
Validation and detection
- Inventory systems with IPv4 forwarding and XFRM/IPsec hardware offload enabled.
- Record running kernel versions, NIC models, drivers, and distribution package revisions.
- Verify the active kernel contains the applicable upstream fix or vendor backport.
- Review kernel logs for panics involving mlx5e_ipsec_handle_tx_skb or mlx5e_xmit.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21720 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c6e1b2cac24b2a4d1dd472071021bf00c26450ebCVE reference, Linux
- https://git.kernel.org/stable/c/6945701ca1572f81bc9bb46f624b02eabb3eaf3eCVE reference, Linux
- https://git.kernel.org/stable/c/981ad4c882096e7375b8c2181dd4c3ee58ea5baeCVE reference, Linux
- https://git.kernel.org/stable/c/600258d555f0710b9c47fb78d2d80a4aecd608ccCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.