Security readout for executives and security teams
Plain-English summary
A race condition in the Linux ibmvnic network driver can access a network-packet object after VIOS has freed it. This may crash or destabilize affected Linux systems and could affect confidentiality or integrity. Exposure appears limited to systems using ibmvnic with VIOS, particularly during Live Partition Mobility activity.
Executive priority
Treat this as a high-priority reliability and security update for IBM virtualized Linux workloads using ibmvnic. Accelerate remediation where service availability is important or Live Partition Mobility is used. Other Linux systems are unlikely to share this specific driver path, but asset validation is necessary.
Technical view
CVE-2025-21855 is a CWE-416 use-after-free in ibmvnic_xmit. After successfully flushing a transmit buffer to VIOS, the driver read skb->len to update tx_bytes. VIOS could trigger an interrupt and free the skb first. Kernel AddressSanitizer confirmed the resulting invalid four-byte read. Stable-kernel commits change this unsafe ordering.
Likely exposure
Prioritize Linux systems using the ibmvnic driver with IBM VIOS-backed virtual networking. The supplied record identifies affected releases including 4.5, 6.1.130, 6.6.80, 6.12.17, 6.13.5, and 6.14, but its version data is ambiguous. Confirm exact exposure against the distribution kernel and referenced fixes.
Exploitation context
The CVSS 3.1 score is 8.6 with a network attack vector and high availability impact. However, the supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. The demonstrated condition is a race, especially during Live Partition Mobility.
Researcher notes
The supplied affected-version data contains an unexplained “0,” duplicate commit identifiers, and no clear range semantics. Avoid deriving precise vulnerable ranges from it alone. The evidence directly establishes a post-transmission skb lifetime race and KASAN-detected read; it does not establish attacker-controlled code execution or exploitation in the wild.
Mitigation direction
- Install a vendor-supported kernel containing the applicable ibmvnic stable fix.
- Consult the Linux distribution or platform vendor for corrected package versions.
- Prioritize systems using ibmvnic and VIOS, especially those performing Live Partition Mobility.
- Apply normal change controls because kernel updates may require rebooting affected systems.
Validation and detection
- Inventory loaded ibmvnic drivers and VIOS-backed virtual network interfaces.
- Record kernel and distribution package versions on potentially affected systems.
- Confirm the installed kernel includes the relevant referenced stable commit or vendor backport.
- Review kernel logs for KASAN use-after-free reports involving ibmvnic_xmit.
- Reassess after patching using vendor-supported networking and mobility tests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21855 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/501ac6a7e21b82e05207c6b4449812d82820f306CVE reference, Linux
- https://git.kernel.org/stable/c/093b0e5c90592773863f300b908b741622eef597CVE reference, Linux
- https://git.kernel.org/stable/c/25dddd01dcc8ef3acff964dbb32eeb0d89f098e9CVE reference, Linux
- https://git.kernel.org/stable/c/abaff2717470e4b5b7c0c3a90e128b211a23da09CVE reference, Linux
- https://git.kernel.org/stable/c/bdf5d13aa05ec314d4385b31ac974d6c7e0997c9CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.