Security readout for executives and security teams
Plain-English summary
A flaw in Linux SLIMbus messaging can cause invalid memory access and a kernel panic when a hardware response arrives after a transaction timeout. The supplied CVSS rating is 7.8 (high) and assumes local, low-privileged access. Systems using the relevant Qualcomm SLIMbus driver deserve prompt review because a crash could disrupt availability.
Executive priority
Treat as high priority on systems using the affected Qualcomm SLIMbus path, especially availability-sensitive devices. Schedule prompt vendor-supported kernel updates after compatibility testing. For Linux systems lacking the relevant driver or hardware, validate non-exposure and retain normal patch cadence rather than assuming fleet-wide critical risk.
Technical view
slim_do_transfer() can time out without freeing its transaction identifier. A delayed interrupt may then reach qcom_slim_ngd_rx_msgq_cb() with an invalid identifier, causing invalid memory access and potentially a fatal kernel exception. The upstream correction frees the identifier before returning the timeout error. The supplied CVSS vector rates confidentiality, integrity, and availability impacts high.
Likely exposure
Exposure appears limited to affected Linux kernels using the relevant SLIMbus messaging path, particularly the Qualcomm NGD controller driver identified in the trace. Version data in the bundle is ambiguous, so kernel commit ancestry and distribution advisories should determine exposure. Systems without this driver or hardware path are less likely to be affected.
Exploitation context
The bundle provides no evidence of active exploitation, and the CVE is not marked as KEV. The CVSS vector describes a local attack requiring low privileges, low complexity, and no user interaction. Public evidence demonstrates a kernel-panic failure, but does not establish practical exploitation for confidentiality or integrity impact.
Researcher notes
The root cause is transaction-lifecycle mishandling during a timeout and delayed-interrupt race. The supplied trace ends in a fatal interrupt-context exception. Multiple stable-kernel commits indicate backports across branches. Exact vulnerable and fixed version boundaries are not reliably expressed in the bundle; use commit containment and vendor package advisories instead of version-string assumptions.
Mitigation direction
- Apply a vendor kernel update containing the cited stable fix.
- Consult distribution advisories to identify the corrected package for each deployed kernel.
- Prioritize systems that load the Qualcomm SLIMbus NGD controller driver.
- Restrict unnecessary local access until affected systems are updated.
Validation and detection
- Inventory kernel versions and distribution package revisions across Linux systems.
- Check whether the SLIMbus and Qualcomm NGD controller modules are present or loaded.
- Compare kernel commit ancestry against the applicable cited stable fix.
- After updating, confirm the running kernel matches the installed corrected package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21914 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9feCVE reference, Linux
- https://git.kernel.org/stable/c/a32e5198a9134772eb03f7b72a7849094c55bda9CVE reference, Linux
- https://git.kernel.org/stable/c/09d34c4cbc38485c7514069f25348e439555b282CVE reference, Linux
- https://git.kernel.org/stable/c/18ae4cee05c310c299ba75d7477dcf34be67aa16CVE reference, Linux
- https://git.kernel.org/stable/c/faac8e894014e8167471a8e4a5eb35a8fefbb82aCVE reference, Linux
- https://git.kernel.org/stable/c/6abf3d8bb51cbaf886c3f08109a0462890b10db6CVE reference, Linux
- https://git.kernel.org/stable/c/0c541c8f6da23e0b92f0a6216d899659a7572074CVE reference, Linux
- https://git.kernel.org/stable/c/dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.