Security readout for executives and security teams
Plain-English summary
CVE-2025-21908 is a Linux kernel NFS deadlock issue. Under specific local conditions, NFS writeback can recurse through memory compaction and block for a long time, causing an availability impact. It is not reported as actively exploited in the provided sources.
Executive priority
Treat as a scheduled but important availability fix. Prioritize NFS-heavy infrastructure and hosts where service hangs would affect production. There is no provided evidence of active exploitation, so this is not an emergency unless affected systems show deadlock symptoms.
Technical view
The flaw is a CWE-667 locking/deadlock issue in nfs_release_folio(). kcompactd-triggered writeback can call nfs_wb_folio(), then recurse back through NFS/NFSD and block. The kernel fix adds PF_KCOMPACTD and current_is_kcompactd() so NFS skips that writeback path from kcompactd.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with NFS in use. The described failure involves NFS loopback on the same host, NFSD, XFS, and memory compaction activity. Systems without NFS usage are less likely to encounter the condition.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, and high availability impact. The sources do not show remote exploitation or active exploitation. Practical impact is denial of service through a kernel deadlock rather than data theft or code execution.
Researcher notes
Evidence is limited to the CVE record and Linux stable commits. The vulnerable behavior is a kernel deadlock path, not a memory corruption issue. Affected-version details in the bundle are incomplete, so confirm exact distribution kernel status with vendor advisories.
Mitigation direction
- Apply a vendor-supported Linux kernel update containing the referenced stable fixes.
- Check distribution advisories for CVE-2025-21908 applicability and package availability.
- Prioritize systems using NFS, especially same-host NFS loopback configurations.
- If patching is delayed, review whether vulnerable NFS loopback usage can be avoided.
Validation and detection
- Inventory Linux kernel versions across NFS servers and clients.
- Confirm vendor kernel changelogs mention CVE-2025-21908 or the referenced stable commits.
- Review kernel logs for prolonged kcompactd blocked-task messages involving NFS writeback.
- Validate whether hosts use NFS loopback with NFSD and XFS.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-667: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21908 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ab0727d6e2196682351c25c1dd112136f6991f11CVE reference, Linux
- https://git.kernel.org/stable/c/5ae31c54cff745832b9bd5b32e71f3d1b607cd1eCVE reference, Linux
- https://git.kernel.org/stable/c/8253ff29edcb429a9a6c75710941c6a16a9a34b1CVE reference, Linux
- https://git.kernel.org/stable/c/ce6d9c1c2b5cc785016faa11b48b6cd317eb367eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Locking
Improper Locking represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.