Security readout for executives and security teams
Plain-English summary
CVE-2025-21881 is a Linux kernel memory-accounting bug in uprobes. A rare interaction with the shared zero page can corrupt page accounting and trigger kernel BUG reports during local activity. The source describes syzkaller reproduction and kernel stable fixes, but provides no CVSS score and no evidence of active exploitation.
Executive priority
Schedule remediation through normal kernel patch cycles, with faster handling for multi-tenant or untrusted-workload hosts. There is no cited active exploitation, but kernel crashes can affect service availability and operational confidence.
Technical view
uprobe_write_opcode() could pass a zero folio into __replace_page(), which unconditionally adjusted RSS and folio refcounts. Because mfill_atomic_pte_zeropage() maps the zero PFN without matching RSS/refcount increments, the path can produce negative RSS and bad page-state errors. The fix rejects zero old folios after get_user_page_vma_remote().
Likely exposure
Linux systems running affected kernel builds before the referenced stable fixes. Exposure is most relevant where local users, containers, or workloads can reach uprobes/eBPF and userfaultfd-related kernel paths. The bundle does not identify remote exposure or specific distributions beyond a Debian LTS advisory reference.
Exploitation context
The record includes a syzkaller reproducer and crash traces, but KEV is false and no cited source states active exploitation. The upstream text calls the zero-folio uprobe case very rare. Treat this as a local stability and potential denial-of-service concern until vendor advisories say otherwise.
Researcher notes
The root condition is a zero folio entering uprobe_write_opcode() and __replace_page() despite mismatched RSS/refcount accounting from zeropage mapping. The source frames this as rare and resolved by rejecting the zero old folio. No exploitability beyond the reproduced crash is established in the bundle.
Mitigation direction
- Apply the relevant Linux stable kernel update or vendor package containing the referenced fix.
- Check Debian LTS and distribution advisories for fixed package versions.
- Prioritize shared multi-user, container-host, CI, and eBPF-enabled systems.
- Review local controls around untrusted access to BPF, uprobes, and userfaultfd features.
- If no vendor fix is available, monitor vendor guidance rather than inventing workarounds.
Validation and detection
- Inventory Linux kernel versions across hosts and images.
- Compare running kernels against vendor advisories and referenced stable commit lineage.
- Check whether affected systems allow untrusted local workloads or containers.
- Confirm updated hosts no longer run pre-fix kernels.
- Review kernel logs for bad page state or bad RSS-counter messages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21881 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c4cb2bfa99513311886c1eb5c1c2ac26f3338a6eCVE reference, Linux
- https://git.kernel.org/stable/c/0b6f19714588cf2366b0364234f97ba963688f63CVE reference, Linux
- https://git.kernel.org/stable/c/13cca2b73e2b0ec3ea6d6615d615395621d22752CVE reference, Linux
- https://git.kernel.org/stable/c/54011fc94422f094eaf47555284de70a4bc32bb9CVE reference, Linux
- https://git.kernel.org/stable/c/bddf10d26e6e5114e7415a0e442ec6f51a559468CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.