Security readout for executives and security teams
Plain-English summary
CVE-2025-21905 is a Linux kernel flaw in the Intel iwlwifi wireless driver. A malformed firmware file string may make the kernel read past the expected buffer while logging it. The published impact is high for confidentiality and availability, but exploitation is local and requires low privileges. No cited source shows active exploitation.
Executive priority
Treat as a high-priority kernel maintenance item, especially for fleets with Intel Wi-Fi hardware. It is not currently supported by cited evidence as internet-exploited or wormable, so prioritize through normal urgent patch cycles rather than emergency incident response.
Technical view
The issue is CWE-125 out-of-bounds read in iwlwifi TLV firmware parsing/logging. The kernel did not guarantee NUL termination before printing a firmware-provided string, potentially reading beyond the TLV and possibly beyond the file buffer. Stable kernel commits limit the printed string to the available buffer size.
Likely exposure
Linux systems using affected kernel builds with the iwlwifi driver are the relevant exposure. Practical exposure depends on deployed kernel version, distro backports, and whether Intel wireless firmware loading paths are present. The source data does not prove remote exposure.
Exploitation context
CVSS is 7.1 with local attack vector, low complexity, low privileges, and no user interaction. Sources do not report known exploitation or CISA KEV listing. Abuse likely requires local ability to influence the firmware file or relevant loading path; the provided sources do not detail a public exploit.
Researcher notes
The record describes a bounds issue during firmware TLV string printing. Affected-version data in the bundle is not fully normalized, so rely on stable commits and distro advisories for exact fixed builds. Avoid assuming exploitability beyond the CVSS local, low-privilege context without additional evidence.
Mitigation direction
- Apply vendor kernel updates or distro security updates addressing CVE-2025-21905.
- For Debian LTS systems, review the cited Debian LTS advisories.
- Confirm the relevant stable kernel fix is included or backported.
- Prioritize laptops, workstations, and servers using Intel iwlwifi hardware.
- If uncertain, follow your Linux vendor’s kernel guidance.
Validation and detection
- Inventory Linux kernel versions across endpoints and servers.
- Identify systems loading the iwlwifi kernel module.
- Check distro advisories for fixed package versions.
- Verify the kernel contains one of the cited stable fixes or vendor backport.
- Confirm reboot into the updated kernel after patching.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 38f0d398
- Linux stable commit c0e626f2
- Linux stable commit 47616b82
- Linux stable commit 88ed69f9
- Linux stable commit b02f8d5a
- Linux stable commit f265e603
- Linux stable commit 59cdda20
- Linux stable commit e0dc2c1b
- Debian LTS advisory May 2025 msg00045
- Debian LTS advisory May 2025 msg00030
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21905 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/38f0d398b6d7640d223db69df022c4a232f24774CVE reference, Linux
- https://git.kernel.org/stable/c/c0e626f2b2390472afac52dfe72b29daf9ed8e1dCVE reference, Linux
- https://git.kernel.org/stable/c/47616b82f2d42ea2060334746fed9a2988d845c9CVE reference, Linux
- https://git.kernel.org/stable/c/88ed69f924638c7503644e1f8eed1e976f3ffa7aCVE reference, Linux
- https://git.kernel.org/stable/c/b02f8d5a71c8571ccf77f285737c566db73ef5e5CVE reference, Linux
- https://git.kernel.org/stable/c/f265e6031d0bc4fc40c4619cb42466722b46eaa9CVE reference, Linux
- https://git.kernel.org/stable/c/59cdda202829d1d6a095d233386870a59aff986fCVE reference, Linux
- https://git.kernel.org/stable/c/e0dc2c1bef722cbf16ae557690861e5f91208129CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.