Security readout for executives and security teams
Plain-English summary
CVE-2025-21726 is a Linux kernel use-after-free in padata reorder_work. A local authenticated user may be able to trigger kernel memory corruption, with high confidentiality, integrity, and availability impact. The supplied evidence does not show remote exploitation or active attacks, but exposed multi-user Linux systems and appliances should be prioritized.
Executive priority
High priority for Linux estates, especially shared or sensitive infrastructure. This is not evidenced as internet-routable or actively exploited, but kernel use-after-free bugs can have severe business impact if a local attacker gains code execution or data access.
Technical view
The flaw is CWE-416 in Linux padata. A race around padata_do_serial, padata_reorder, serial work queues, and algorithm deletion can leave reorder_work using freed pd state. The upstream fix adds a pd reference before queuing reorder_work and releases it after serial_wq finishes.
Likely exposure
Exposure is likely on systems running affected Linux kernel versions or vendor kernels without the stable backport. Highest concern is shared Linux hosts, containers relying on host kernels, and products tracking vulnerable kernel branches. Siemens and Debian references indicate downstream vendor relevance, but exact affected product scope must be confirmed there.
Exploitation context
CVSS indicates local attack vector, low complexity, low privileges, and no user interaction. The source bundle marks KEV as false, and no supplied source states active exploitation. Treat this as a local privilege or kernel-compromise risk until vendor guidance narrows practical exploitability.
Researcher notes
Focus review on padata reorder_work lifetime handling and whether downstream kernels carry the pd reference fix. Do not assume all products using Linux are affected; confirm exact vendor kernel branches and advisory mappings. Evidence is strongest for the upstream kernel issue and referenced stable fixes.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes or backports.
- Review Debian LTS advisories if using affected Debian kernel packages.
- Review Siemens SSA-265688 for affected Siemens product status and remediation.
- Prioritize patching multi-user systems and high-value Linux infrastructure.
- If no vendor package exists, track vendor guidance before changing kernels manually.
Validation and detection
- Inventory running kernel versions across Linux servers, appliances, and container hosts.
- Map each kernel to vendor advisories or referenced stable commits.
- Confirm whether downstream packages include the reorder_work reference-count fix.
- Check vulnerability scanners for CVE-2025-21726 coverage and validate manually.
- Document exceptions where vendor product exposure is not yet confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21726 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0CVE reference, Linux
- https://git.kernel.org/stable/c/4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1CVE reference, Linux
- https://git.kernel.org/stable/c/7000507bb0d2ceb545c0a690e0c707c897d102c2CVE reference, Linux
- https://git.kernel.org/stable/c/6f45ef616775b0ce7889b0f6077fc8d681ab30bcCVE reference, Linux
- https://git.kernel.org/stable/c/8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cacCVE reference, Linux
- https://git.kernel.org/stable/c/a54091c24220a4cd847d5b4f36d678edacddbaf0CVE reference, Linux
- https://git.kernel.org/stable/c/dd7d37ccf6b11f3d95e797ebe4e9e886d0332600CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.