Security readout for executives and security teams
Plain-English summary
CVE-2025-21761 is a Linux kernel memory-safety flaw in Open vSwitch handling. It is local, not directly internet-exploitable from the CVSS data, but a low-privileged local attacker on an affected system could threaten confidentiality, integrity, and availability.
Executive priority
Prioritize remediation in the next kernel maintenance window, faster for multi-tenant, cloud, container, virtualization, or network infrastructure hosts. This is high severity but not evidenced as remotely exploitable or actively exploited in the provided sources.
Technical view
The issue is a potential use-after-free in ovs_vport_cmd_fill_info(), which could be called without RTNL or RCU protection. Kernel stable fixes add RCU protection and use dev_net_rcu(). The CVE is CWE-416 with CVSS 3.1 score 7.8, local attack vector, low privileges required.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions where Open vSwitch kernel functionality is present or packaged through affected distributions or products. The bundle names Linux kernel versions and includes Debian LTS and Siemens advisories, but does not fully enumerate all downstream affected products.
Exploitation context
The source bundle does not show CISA KEV listing or public active exploitation. The attack vector is local with low privileges required and no user interaction. Treat this as a serious local privilege or kernel compromise risk where untrusted users or workloads share affected hosts.
Researcher notes
Focus analysis on the missing RTNL or RCU protection around ovs_vport_cmd_fill_info() and resulting UAF risk. The bundle provides fix commits but not exploit details, proof-of-concept status, or complete downstream version mapping.
Mitigation direction
- Apply vendor kernel updates containing the stable Open vSwitch fix.
- Prioritize shared Linux hosts and virtualization or container platforms using Open vSwitch.
- Review Debian LTS and Siemens guidance where those distributions or products are used.
- If patching is delayed, reduce untrusted local access to affected systems.
- Avoid inventing compensating controls; follow vendor-specific mitigation guidance.
Validation and detection
- Inventory Linux kernel versions against the affected version ranges in the CVE record.
- Confirm whether Open vSwitch kernel functionality is installed or enabled.
- Check distribution advisories for fixed kernel package versions.
- Verify the relevant stable kernel fix is included in deployed kernels.
- Document systems where vendor status is unclear or awaiting backport confirmation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21761 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e85a25d1a9985645e796039e843d1de581d2de1eCVE reference, Linux
- https://git.kernel.org/stable/c/a8816b3f1f151373fd30f1996f00480126c8bb11CVE reference, Linux
- https://git.kernel.org/stable/c/a884f57600e463f69d7b279c4598b865260b62a1CVE reference, Linux
- https://git.kernel.org/stable/c/7e01abc34e87abd091e619161a20f54ed4e3e2daCVE reference, Linux
- https://git.kernel.org/stable/c/8ec57509c36c8b9a23e50b7858dda0c520a2d074CVE reference, Linux
- https://git.kernel.org/stable/c/a849a10de5e04d798f7f286a2f1ca174719a617aCVE reference, Linux
- https://git.kernel.org/stable/c/5828937742af74666192835d657095d95c53dbd0CVE reference, Linux
- https://git.kernel.org/stable/c/90b2f49a502fa71090d9f4fe29a2f51fe5dff76dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.