Security readout for executives and security teams
Plain-English summary
This is a Linux kernel availability bug in the ctucanfd CAN driver. If memory allocation fails in one error-handling path, the kernel may dereference a NULL pointer and crash. The business impact is likely service disruption on systems that use this driver, not data theft or remote takeover based on the provided sources.
Executive priority
Treat this as a targeted availability risk. Prioritize patching for operational systems that depend on Linux CAN interfaces, especially where downtime affects safety, manufacturing, fleet operations, or field devices. It is not currently supported by the sources as an internet-scale emergency.
Technical view
CVE-2025-21775 is a CWE-476 NULL pointer dereference in Linux kernel CAN ctucanfd error interrupt handling. The fix adds a missed NULL check after skb allocation failure. CVSS 3.1 is 5.5: local attack vector, low complexity, low privileges, no confidentiality or integrity impact, high availability impact.
Likely exposure
Exposure is most plausible on Linux systems with affected kernel builds and the ctucanfd CAN driver present or in use. This is more relevant to embedded, automotive, industrial, or lab systems using CAN hardware than general internet-facing servers.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. The CVSS vector indicates local access with low privileges is required. The documented impact is availability loss through a kernel crash condition, not remote code execution.
Researcher notes
The public description attributes discovery to Linux Verification Center using SVACE static analysis. Evidence is limited to the CVE record, Linux stable commits, and Debian LTS reference. Affected-version detail in the bundle is sparse, so rely on vendor kernel advisories for exact package applicability.
Mitigation direction
- Apply Linux kernel updates that include the referenced stable fixes.
- Check Debian LTS guidance where Debian kernels are in scope.
- Inventory systems using the ctucanfd CAN driver or CAN hardware.
- If patching is delayed, restrict local access to affected CAN-capable systems.
- Monitor kernel crash logs for ctucanfd or ctucan_err_interrupt failures.
Validation and detection
- Confirm each system's kernel version and vendor patch status.
- Verify whether the ctucanfd driver is built, loaded, or used.
- Prioritize validation on embedded, automotive, industrial, and test-bench Linux systems.
- Review crash telemetry for NULL pointer dereferences in CAN error handling.
- Test updated kernels in staging before production rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21775 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/84b9ac59978a6a4e0812d1c938fad97306272cefCVE reference, Linux
- https://git.kernel.org/stable/c/e505b83b9ee6aa0ae2f4395f573a66579ae403fbCVE reference, Linux
- https://git.kernel.org/stable/c/b0e592dd46a0a952b41c3bf6c963afdd6a42b526CVE reference, Linux
- https://git.kernel.org/stable/c/e7e2e2318b1f085044126ba553a4e619842fc36dCVE reference, Linux
- https://git.kernel.org/stable/c/9bd24927e3eeb85642c7baa3b28be8bea6c2a078CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.