Security readout for executives and security teams
Plain-English summary
CVE-2025-21830 is a Linux kernel Landlock flaw involving unusual file objects returned by a corrupted filesystem. Instead of denying access safely, Landlock could warn and permit access. The supplied CVSS score is 7.3, reflecting possible limited integrity impact and significant disruption, but no confidentiality impact.
Executive priority
Prioritize remediation on shared, sandboxing, or workload-isolation hosts that rely on Landlock, particularly where local untrusted users or filesystem corruption are plausible. Treat this as a high-priority hardening update, not a confirmed emergency campaign, because active exploitation is not supported by the supplied evidence.
Technical view
When a filesystem such as bcachefs returns an unexpected file type, vulnerable Landlock handling warns and allows access. The kernel fix treats these objects as regular files so normal Landlock restrictions apply. The CVSS vector requires local access and low privileges, with no user interaction; it indicates changed scope, low integrity impact, and high availability impact.
Likely exposure
Exposure primarily concerns Linux systems using Landlock where corrupted or unusual filesystem objects can occur. The supplied affected-version data lists several kernel releases but is ambiguous, including an unexplained “0” value. Distribution kernels may contain backports, so determine exposure using vendor advisories and fix-commit presence rather than version numbers alone.
Exploitation context
The bundle marks this CVE as absent from KEV and supplies no evidence of active exploitation. Exploitation requires local, low-privileged access and the relevant filesystem condition. Public exploit availability is not established by the supplied sources, so operational risk should be assessed without assuming weaponization.
Researcher notes
The vulnerable behavior is fail-open handling of unexpected filesystem objects within Landlock. The fix changes classification to regular-file treatment. Exact affected ranges cannot be reliably reconstructed from the bundle’s version array; compare distribution source packages or custom kernel trees against the branch-specific stable commits. No CWE classification is supplied.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Prioritize Landlock-enabled systems that process untrusted or potentially corrupted filesystems.
- Follow Linux distribution guidance for backported fixes and required reboot procedures.
- Restrict unnecessary local access while affected systems await remediation.
Validation and detection
- Inventory running kernel and distribution package versions on Landlock-enabled systems.
- Check vendor advisories for whether each kernel package contains the fix.
- Verify the applicable stable fix commit is present in custom kernel trees.
- After updating, confirm systems booted into the remediated kernel.
- Review filesystem health alerts for corruption or unexpected file-object conditions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21830 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H24.7LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a1fccf6b72b56343dd4f2d96b008147f9951eebdCVE reference, Linux
- https://git.kernel.org/stable/c/7d6121228959ddf44a4b9b6a177384ac7854e2f9CVE reference, Linux
- https://git.kernel.org/stable/c/39bb3d56f1c351e76bb18895d0e73796e653d5c1CVE reference, Linux
- https://git.kernel.org/stable/c/2569e65d2eb6ac1afe6cb6dfae476afee8b6771aCVE reference, Linux
- https://git.kernel.org/stable/c/0fde195a373ab1267e60baa9e1a703a97e7464cdCVE reference, Linux
- https://git.kernel.org/stable/c/49440290a0935f428a1e43a5ac8dc275a647ff80CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.