Security readout for executives and security teams
Plain-English summary
This is a Linux kernel availability bug in FireWire KUnit test code. A failed allocation can be dereferenced, causing a NULL pointer crash. The supplied evidence does not show remote exposure, data theft, privilege escalation, or active exploitation.
Executive priority
Handle through normal kernel patch governance unless affected kernel test paths are operationally important. There is no supplied evidence of internet exposure or active exploitation, but a local availability crash still matters for reliability-sensitive environments.
Technical view
CVE-2025-21798 is a CWE-476 NULL pointer dereference in Linux FireWire test code. kunit_kzalloc() can return NULL, and test_state was dereferenced without checking. The fix adds a NULL check. CVSS 3.1 is 5.5: local access, low privileges, no user interaction, availability impact only.
Likely exposure
Exposure appears limited to affected Linux kernel versions and code paths involving the FireWire KUnit test. The bundle lists Linux 6.8, 6.12.13, 6.13.2, and 6.14 as affected evidence points, but version range details are incomplete.
Exploitation context
The bundle marks KEV as false and provides no evidence of active exploitation. CVSS indicates local, low-complexity exploitation with low privileges and availability impact. The described flaw is a NULL dereference, not a code execution issue.
Researcher notes
The source evidence is narrow: it identifies a KUnit allocation failure path and stable kernel commits. It does not provide exploit details, distribution-specific fixed versions, or proof of real-world exploitation. Treat affected version boundaries cautiously and defer to vendor advisories.
Mitigation direction
- Check Linux vendor or distribution advisories for CVE-2025-21798 coverage.
- Update affected kernels to builds containing the referenced stable commits.
- For custom kernels, apply the upstream fix adding the test_state NULL check.
- Prioritize systems that build or run affected kernel KUnit test code.
Validation and detection
- Inventory Linux kernel versions against the CVE record and vendor advisories.
- Confirm the kernel source includes a NULL check after kunit_kzalloc().
- Review package changelogs for CVE-2025-21798 or referenced stable commits.
- Verify affected FireWire KUnit test code is absent, disabled, or patched.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21798 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c6896bf4c611c3dd126f3e03685f2360a18b3d6fCVE reference, Linux
- https://git.kernel.org/stable/c/70fcb25472d90dd3b87cbee74b9eb68670b0c7b8CVE reference, Linux
- https://git.kernel.org/stable/c/352fafe97784e81a10a7c74bd508f71a19b53c2aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.