Security readout for executives and security teams
Plain-English summary
A Linux VSOCK lifecycle error can free a socket while the kernel still uses it. A local user with low privileges may be able to trigger memory corruption, potentially affecting confidentiality, integrity, or availability. The CVSS score is 7.8. No supplied source shows active exploitation.
Executive priority
Treat this as a high-priority operating-system update for systems exposing VSOCK to local users or workloads. Prioritize shared and sensitive systems because successful memory corruption could have broad impact. Emergency incident response is not supported by the current exploitation evidence.
Technical view
During VSOCK transport reassignment, the kernel could remove a socket from a binding list incorrectly. A later bind operation could reduce its reference count to zero and continue accessing the freed socket, causing a CWE-416 use-after-free. The fix preserves explicit and automatic bindings until socket destruction.
Likely exposure
Exposure requires an affected Linux kernel and local access to the vulnerable VSOCK behavior. Systems where VSOCK is available should be assessed first. The bundle reports multiple affected kernel lines beginning with 5.5, but does not provide enough normalized version data to determine every vulnerable vendor build.
Exploitation context
The supplied CVSS vector indicates local, low-complexity exploitation requiring low privileges and no user interaction. The CVE is not listed as KEV, and the supplied sources provide no evidence of exploitation in the wild or a public weaponized exploit.
Researcher notes
The demonstrated failure includes slab use-after-free, reference-count addition on zero, and underflow in VSOCK bind and release paths. Stable-kernel commits are supplied for several branches. Exact exploitability and affected downstream package versions are not established by this bundle, so vendor backport status must be verified.
Mitigation direction
- Install a vendor-supported kernel containing the referenced VSOCK binding fix.
- Reboot into the updated kernel after installation.
- Check Debian or Siemens advisories when those supported products are present.
- If updates are unavailable, request product-specific mitigation guidance from the vendor.
Validation and detection
- Inventory running kernel versions on systems where VSOCK is available.
- Confirm the installed kernel includes an applicable referenced stable commit or vendor backport.
- Verify systems are running the updated kernel after reboot.
- Review kernel logs for VSOCK, KASAN, refcount, or use-after-free warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21756 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e7754d564579a5db9c5c9f74228df5d6dd6f1173CVE reference, Linux
- https://git.kernel.org/stable/c/e48fcb403c2d0e574c19683f09399ab4cf67809cCVE reference, Linux
- https://git.kernel.org/stable/c/42b33381e5e1f2b967dc4fb4221ddb9aaf10d197CVE reference, Linux
- https://git.kernel.org/stable/c/3f43540166128951cc1be7ab1ce6b7f05c670d8bCVE reference, Linux
- https://git.kernel.org/stable/c/645ce25aa0e67895b11d89f27bb86c9d444c40f8CVE reference, Linux
- https://git.kernel.org/stable/c/b1afd40321f1c243cffbcf40ea7ca41aca87fa5eCVE reference, Linux
- https://git.kernel.org/stable/c/fcdd2242c0231032fc84e1404315c245ae56322aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.