Security readout for executives and security teams
Plain-English summary
A race condition in the Linux CDX driver could let a local user trigger access to freed memory while a sysfs value is being changed. The documented consequence is possible disclosure of a kernel address. The CVSS score is 7.8, but the supplied sources do not establish active exploitation.
Executive priority
Schedule accelerated remediation for affected multi-user or shared Linux systems using CDX. This is high severity but not an emergency based solely on the supplied evidence: exploitation is local, environmental prerequisites apply, and active abuse is not documented. Confirm exposure before broad operational disruption.
Technical view
CVE-2025-21915 is a CWE-416 use-after-free in drivers/cdx/cdx.c. driver_override_show() could read cdx_dev->driver_override without the device lock while driver_override_store() concurrently replaces and frees that string. Stable-kernel commits add synchronization to the read path.
Likely exposure
Exposure requires an affected Linux kernel, the CDX driver path, access to the relevant sysfs attribute, and local low-privileged access. The supplied version list is ambiguous, including an unexplained “0” entry, so distribution-specific kernel advisories and backport records should determine actual exposure.
Exploitation context
The supplied record marks this CVE as absent from KEV and provides no evidence of exploitation in the wild or a public proof of concept. Detection came from experimental static analysis. Treat active exploitation as unconfirmed.
Researcher notes
The vulnerable read and concurrent update lack matching device locking, creating a potential stale-pointer dereference. The stated observable risk is kernel-address disclosure through a world-readable DEVICE_ATTR. Although CVSS assigns high confidentiality, integrity, and availability impacts, the supplied narrative does not demonstrate those broader outcomes.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced fix or an equivalent backport.
- Prioritize multi-user systems where CDX devices and the affected sysfs interface are available.
- If immediate updating is impossible, check vendor guidance for supported temporary mitigations.
- Restrict unnecessary local accounts and sysfs write access while remediation is pending.
Validation and detection
- Inventory deployed kernel versions and distribution package revisions.
- Confirm whether the CDX subsystem and relevant driver_override sysfs attribute are present.
- Verify the installed kernel contains a referenced stable commit or documented vendor backport.
- Review vendor changelogs because the supplied affected-version data is ambiguous.
- Perform any concurrency testing only in an isolated, non-production environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21915 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bfCVE reference, Linux
- https://git.kernel.org/stable/c/8473135f89c0949436a22adb05b8cece2fb3da91CVE reference, Linux
- https://git.kernel.org/stable/c/0439d541aa8d3444ad41c39e39eb71acb57acde3CVE reference, Linux
- https://git.kernel.org/stable/c/91d44c1afc61a2fec37a9c7a3485368309391e0bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.