Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can leave systems stuck during reboot or shutdown when the OP-TEE supplicant process hangs, crashes, or is killed during a trusted execution RPC. The practical business risk is availability: affected devices may require hard power cycling to recover.
Executive priority
Treat as a targeted availability risk for OP-TEE-enabled Linux systems rather than a broad internet-facing emergency. Patch during normal kernel maintenance, with higher priority for devices where hard power recovery is costly or remote recovery is limited.
Technical view
The OP-TEE TEE driver could wait indefinitely for a userspace supplicant response, leaving a client process stuck in an unkillable kernel wait. The fix changes the wait behavior so the client can be killed instead of looping forever and triggering hung-task conditions.
Likely exposure
Exposure is most likely on Linux systems using OP-TEE trusted execution support. The source metadata lists Linux kernel stable lines and Debian LTS references, but package-level exposure depends on kernel version, configuration, and vendor backports.
Exploitation context
The provided sources do not show active exploitation, public weaponization, or CISA KEV listing. The described failure mode is operational disruption caused by supplicant crash, kill, or shutdown ordering issues, not confirmed remote compromise.
Researcher notes
Evidence supports an availability bug in the kernel OP-TEE supplicant wait path. CVSS and CWE data are absent in the bundle. Avoid assuming exploitability beyond inducing or encountering supplicant failure unless additional vendor analysis confirms an attack path.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- Prioritize OP-TEE-enabled embedded, appliance, and edge systems.
- Check Debian LTS advisories if running affected Debian kernels.
- Review reboot and shutdown reliability on managed device fleets.
- Monitor vendor advisories for backported package versions.
Validation and detection
- Inventory Linux systems with OP-TEE support enabled.
- Compare running kernel packages with vendor fixed advisories.
- Review logs for hung-task watchdog or shutdown hangs involving OP-TEE.
- Confirm updated kernels include the referenced stable commit lineage.
- Test controlled reboot and shutdown after patching.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 3eb4911364c7
- Linux stable commit 0180cf0373f8
- Linux stable commit c0a9a9481591
- Linux stable commit ec18520f5edc
- Linux stable commit d61cc1a435e6
- Linux stable commit fd9d2d6124c2
- Linux stable commit 21234efe2a84
- Linux stable commit 70b0d6b0a199
- Debian LTS advisory May 2025 msg00045
- Debian LTS advisory May 2025 msg00030
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21871 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3eb4911364c764572e9db4ab900a57689a54e8ceCVE reference, Linux
- https://git.kernel.org/stable/c/0180cf0373f84fff61b16f8c062553a13dd7cfcaCVE reference, Linux
- https://git.kernel.org/stable/c/c0a9a948159153be145f9471435695373904ee6dCVE reference, Linux
- https://git.kernel.org/stable/c/ec18520f5edc20a00c34a8c9fdd6507c355e880fCVE reference, Linux
- https://git.kernel.org/stable/c/d61cc1a435e6894bfb0dd3370c6f765d2d12825dCVE reference, Linux
- https://git.kernel.org/stable/c/fd9d2d6124c293e40797a080adf8a9c237efd8b8CVE reference, Linux
- https://git.kernel.org/stable/c/21234efe2a8474a6d2d01ea9573319de7858ce44CVE reference, Linux
- https://git.kernel.org/stable/c/70b0d6b0a199c5a3ee6c72f5e61681ed6f759612CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.