Security readout for executives and security teams
Plain-English summary
A Linux IPv4 networking race could let a kernel network structure disappear while still being read. Successful exploitation may compromise confidentiality, integrity, and availability, but requires difficult timing conditions. Prioritize affected internet-facing and critical Linux systems.
Executive priority
Treat as a high-priority kernel update, especially for exposed or shared infrastructure. Accelerate remediation where compromise would disrupt critical services or sensitive data. Current sources do not support an emergency response based on active exploitation, but the potential impact justifies timely patching.
Technical view
The kernel function __ip_rt_update_pmtu() accessed a network namespace structure without required RCU lifetime protection. Concurrent teardown could invalidate that structure during use. The upstream correction adds RCU protection. CVSS 3.1 scores it 8.1: network-reachable, no privileges or user interaction, but high attack complexity.
Likely exposure
Exposure applies to Linux systems running affected kernels or vendor products incorporating them, particularly where IPv4 networking is active. The supplied version data mixes releases and commit identifiers, so distribution package versions cannot be judged by upstream numbers alone. Vendor backport status must be checked.
Exploitation context
The CVSS vector describes network reachability with no privileges or user interaction, but high complexity. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Treat exploitation status as unconfirmed, not impossible.
Researcher notes
The core issue is a lifetime-synchronization failure involving a net structure in IPv4 PMTU handling. No CWE is supplied. Version records are ambiguous because they combine commits and releases; validate reachability through vendor package provenance and backports. The sources establish a fix but do not establish practical exploitability or observed attacks.
Mitigation direction
- Install a vendor-supported kernel update containing the upstream RCU fix.
- Consult Linux distribution advisories for package-specific fixed versions and backport status.
- Review Siemens guidance before updating any affected Siemens product or appliance.
- Prioritize internet-facing, multi-tenant, and business-critical Linux systems.
- Use vendor-recommended compensating controls if immediate patching is unavailable.
Validation and detection
- Inventory running kernel and distribution package versions across Linux systems.
- Compare packages against distribution advisories, not upstream version numbers alone.
- Confirm the installed update contains the __ip_rt_update_pmtu() RCU correction.
- Reboot updated systems when required, then verify the active kernel version.
- Check affected Siemens assets against SSA-082556 and applicable product versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21766 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ce3c6165fce0f06305c806696882a3ad4b90e33fCVE reference, Linux
- https://git.kernel.org/stable/c/ea07480b23225942208f1b754fea1e7ec486d37eCVE reference, Linux
- https://git.kernel.org/stable/c/9b1766d1ff5fe496aabe9fc5f4e34e53f35c11c4CVE reference, Linux
- https://git.kernel.org/stable/c/4583748b65dee4d61bd50a2214715b4237bc152aCVE reference, Linux
- https://git.kernel.org/stable/c/a39f61d212d822b3062d7f70fa0588e50e55664eCVE reference, Linux
- https://git.kernel.org/stable/c/139512191bd06f1b496117c76372b2ce372c9a41CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.