Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s LoongArch IP checksum code can read beyond a valid memory boundary when given a negative length. Successful abuse could expose sensitive kernel data, alter limited data, or disrupt availability. The supplied CVSS score is 7.3, but the issue is specific to affected LoongArch kernels and requires local, low-privileged access.
Executive priority
Treat as a high-priority, architecture-specific patching issue. Promptly identify LoongArch Linux assets, then remediate exposed multi-user and untrusted-workload systems first. Broad emergency action across non-LoongArch infrastructure is not supported by the supplied evidence.
Technical view
The LoongArch 64-bit checksum optimization introduced by commit 69e3a6aa6be2 can perform an undefined shift and out-of-bounds read when processing negative lengths. The issue is classified as CWE-125. Linux stable fixes are referenced for multiple maintained branches.
Likely exposure
Exposure is limited to systems running affected Linux versions on LoongArch architecture with the vulnerable checksum optimization. Other architectures are not identified as affected by this CVE. The supplied version data is ambiguous, so confirm exposure against the relevant distribution’s advisory and fix history.
Exploitation context
The supplied CVSS vector indicates a local attack requiring low privileges, low complexity, and no user interaction. CISA KEV status is false, and the provided sources do not report active exploitation or a public exploit. Practical reachability of the negative-length condition is not established in the bundle.
Researcher notes
The evidence identifies an undefined shift and out-of-bounds read in LoongArch checksum handling for negative lengths. Four stable-tree fixes are supplied, but the flattened version list does not clearly express affected and fixed ranges. No source establishes remote reachability, active exploitation, or exploit availability.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable Linux stable fix.
- Consult the Linux distribution’s advisory for corrected package versions and backport status.
- Prioritize affected multi-user or untrusted-workload LoongArch systems.
- Restrict local access where patching cannot occur promptly.
Validation and detection
- Inventory LoongArch systems and record their running kernel builds.
- Check vendor package changelogs for CVE-2025-21789 or the referenced stable fix.
- Confirm the running kernel includes the applicable fix after updating.
- Monitor affected systems for unexplained kernel faults or availability disruption.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21789 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/964a8895704a22efc06a2a3276b624a5ae985a06CVE reference, Linux
- https://git.kernel.org/stable/c/9f15a8df542c0f08732a67d1a14ee7c22948fb97CVE reference, Linux
- https://git.kernel.org/stable/c/d6508ffff32b44b6d0de06704034e4eef1c307a7CVE reference, Linux
- https://git.kernel.org/stable/c/6287f1a8c16138c2ec750953e35039634018c84aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.