Security readout for executives and security teams
Plain-English summary
CVE-2025-21773 is a Linux kernel availability flaw in the ETAS ES58x CAN USB driver. A locally positioned attacker with the ability to present a spoofed USB device can make the kernel hit a NULL pointer dereference, potentially crashing the system. This is not reported as actively exploited in the provided sources.
Executive priority
Treat as a targeted availability risk, not a broad remote compromise issue. Prioritize patching on engineering, automotive, industrial, and lab systems where CAN USB adapters or local USB access are realistic.
Technical view
The etas_es58x driver assumed udev->serial was never NULL. The CVE states a spoofed device identity with no USB serial number can trigger a NULL pointer dereference. The kernel fix adds a NULL check before accessing the serial value. CVSS is 5.5: local, low complexity, low privileges, no user interaction, high availability impact.
Likely exposure
Exposure is most relevant to Linux systems that load the etas_es58x CAN USB driver and allow local USB device attachment. Typical internet-facing servers are unlikely to be directly exposed unless local hardware access or USB redirection paths exist.
Exploitation context
The provided record does not show CISA KEV listing or other evidence of active exploitation. The attack requires local access and a spoofed USB identity, so risk is concentrated in shared workstations, labs, industrial test benches, and systems accepting untrusted USB devices.
Researcher notes
Evidence is limited to the CVE record and Linux stable commit references. Do not infer confidentiality or integrity impact. Validation should focus on kernel branch, driver presence, and whether local USB device spoofing is plausible in the environment.
Mitigation direction
- Apply Linux kernel or distribution updates that include the referenced etas_es58x fix.
- Check vendor kernel advisories for exact fixed package versions in your distribution.
- Restrict physical or redirected USB access to trusted users and devices.
- Disable or avoid loading the etas_es58x driver where ETAS ES58x hardware is not used.
Validation and detection
- Inventory Linux systems using ETAS ES58x CAN USB adapters or loading etas_es58x.
- Check running kernel versions against distribution advisories for CVE-2025-21773.
- Confirm updated kernels include the NULL serial-number check from the stable commits.
- Review endpoint and lab controls for untrusted USB attachment paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21773 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1590667a60753ee5a54871f2840ceefd4a7831faCVE reference, Linux
- https://git.kernel.org/stable/c/722e8e1219c8b6ac2865011fe339315d6a8d0721CVE reference, Linux
- https://git.kernel.org/stable/c/5059ea98d7bc133903d3e47ab36df6ed11d0c95fCVE reference, Linux
- https://git.kernel.org/stable/c/a1ad2109ce41c9e3912dadd07ad8a9c640064ffbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.