Security readout for executives and security teams
Plain-English summary
CVE-2025-21753 is a Linux kernel Btrfs bug where a transaction object can be used after it has been freed. A local user could potentially crash the system or affect kernel memory integrity. The CVSS score is high, but the sources do not show confirmed exploitation in the wild.
Executive priority
Treat this as high priority for Linux fleets using Btrfs or hosting untrusted local workloads. It is not shown as actively exploited, but kernel memory corruption with low-privilege local access can become business-critical on shared systems.
Technical view
The flaw is a CWE-416 use-after-free in Btrfs transaction handling. join_transaction reads a transaction aborted field after releasing fs_info->trans_lock without holding an extra reference, allowing a concurrent abort path to free the transaction first. The fix reads the field while holding the lock. KASAN traces from syzbot/Dmitry support the issue.
Likely exposure
Exposure is most relevant to Linux systems using Btrfs or allowing local users, containers, or workloads to trigger Btrfs filesystem operations. Systems not using Btrfs are less likely to be practically exposed, though kernel package inventory still matters.
Exploitation context
The source bundle says KEV is false and provides no cited evidence of active exploitation. Evidence comes from syzbot/KASAN crash traces, indicating reproducible memory-safety behavior in testing. The CVSS vector is local, low complexity, low privilege, no user interaction.
Researcher notes
Do not assume remote exposure from the provided sources. The issue is in Btrfs transaction concurrency around aborted transactions. Affected-version data in the bundle is coarse and commit-heavy, so validation should rely on vendor kernel advisories, package changelogs, and stable commit inclusion.
Mitigation direction
- Update Linux kernels using vendor-supported packages that include the Btrfs fix.
- Prioritize hosts using Btrfs and shared multi-user or containerized workloads.
- Apply relevant Debian LTS kernel updates where Debian advisories apply.
- Check distribution or appliance vendor guidance for exact fixed kernel builds.
- Restrict unnecessary local shell or workload access on affected Btrfs systems until patched.
Validation and detection
- Inventory Linux kernel versions and identify systems with Btrfs enabled or mounted.
- Compare installed kernels against vendor advisories and stable kernel fix references.
- Confirm Debian LTS systems have the referenced security updates installed.
- Review vulnerability scanner findings for CVE-2025-21753 and validate against actual kernel packages.
- After patching, confirm systems boot the updated kernel, not only install it.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit cee55b121956
- Linux stable commit c7a53757717e
- Linux stable commit 7e954b6bb95d
- Linux stable commit 6ba4663ada6c
- Linux stable commit 8f5cff471039
- Linux stable commit 86d71a026a7f
- Linux stable commit ce628048390d
- Linux stable commit e2f0943cf373
- Debian LTS announcement May 2025
- Debian LTS announcement March 2025
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21753 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cee55b1219568c80bf0d5dc55066e4a859baf753CVE reference, Linux
- https://git.kernel.org/stable/c/c7a53757717e68af94a56929d57f1e6daff220ecCVE reference, Linux
- https://git.kernel.org/stable/c/7e954b6bb95d67ae4d1a20e9cfd83c182cf929bcCVE reference, Linux
- https://git.kernel.org/stable/c/6ba4663ada6c6315af23a6669d386146634808ecCVE reference, Linux
- https://git.kernel.org/stable/c/8f5cff471039caa2b088060c074c2bf2081bcb01CVE reference, Linux
- https://git.kernel.org/stable/c/86d71a026a7f63da905db9add845c8ee88801ecaCVE reference, Linux
- https://git.kernel.org/stable/c/ce628048390dad80320d5a1f74de6ca1e1be91e7CVE reference, Linux
- https://git.kernel.org/stable/c/e2f0943cf37305dbdeaf9846e3c941451bcdef63CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.