Security readout for executives and security teams
Plain-English summary
This Linux kernel issue affects the vmclock Precision Time Protocol driver. If setup fails at a specific point, cleanup may use driver state before it has been recorded, potentially causing a kernel fault during device probing. The public record does not provide a CVSS score, CWE, practical impact, or evidence of exploitation.
Executive priority
Treat as a kernel maintenance item with uncertain business impact. Escalate only if critical systems run affected kernels with vmclock enabled, or if your vendor rates it more severely.
Technical view
During vmclock_probe, vmclock_ptp_register() failure can call vmclock_remove(), which reads vmclock state via dev_get_drvdata(). Driver data was assigned too late, so cleanup may dereference missing state. The fix assigns driver data earlier. Sources list affected Linux kernel versions around 6.13 and stable commits resolving the issue.
Likely exposure
Likely limited to systems running affected Linux kernel builds with the vmclock driver present and probed. The source bundle does not identify distributions, appliances, cloud platforms, or configurations confirmed exposed.
Exploitation context
No cited source reports active exploitation, and the CVE is not listed as KEV in the supplied bundle. The described trigger is an internal driver probe failure path, not a documented remote attack path.
Researcher notes
The evidence supports a cleanup-order bug in the vmclock PTP driver. Public metadata lacks CVSS, CWE, exploitability analysis, and downstream advisory detail. Avoid broad claims beyond affected Linux kernel versions and the fix behavior.
Mitigation direction
- Review vendor kernel advisories for your distribution or platform.
- Update to a kernel containing the referenced stable fixes.
- Prioritize hosts using affected 6.13-era kernels and virtualization time devices.
- Avoid assuming appliance exposure without vendor confirmation.
Validation and detection
- Inventory Linux kernel versions across servers and images.
- Check whether affected kernels include the vmclock driver.
- Confirm vendor packages include the stable fix commits.
- Review kernel logs for vmclock probe or registration failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21822 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6dbd8b91a065d1d8001446a28e72cd140f9acef0CVE reference, Linux
- https://git.kernel.org/stable/c/f7d07cd4f77d77f366c8ffbb8ba8b61f614e5fceCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.