Security readout for executives and security teams
Plain-English summary
This is a Linux kernel USB driver flaw in the cxacru USB ATM driver. A specially malformed or incompatible USB device can pass incomplete endpoint checks and trigger invalid USB request handling. The public sources show a kernel fix, but no evidence of active exploitation or broad remote exposure.
Executive priority
Treat as a targeted kernel maintenance issue, not an emergency remote-exploitation event. Prioritize patching where untrusted USB devices or virtualized USB passthrough exist, and fold the fix into standard kernel update cycles elsewhere.
Technical view
cxacru_bind() accepted endpoints based on type and count without verifying the endpoint address expected by CXACRU_EP_CMD. Syzbot reported a usb_submit_urb warning caused by a bogus transfer type. The fix changes endpoint verification to address-aware usb_check_* endpoint checks in stable Linux commits.
Likely exposure
Exposure is mainly on Linux systems that include and can load the cxacru USB ATM driver, especially where physical USB access, USB passthrough, or untrusted USB devices are possible. Internet-facing exposure is not indicated by the sources.
Exploitation context
The provided sources cite Syzbot discovery and kernel remediation. CISA KEV status is false, and the bundle provides no public evidence of active exploitation, exploit availability, privilege impact, or remote attack path.
Researcher notes
Evidence supports an endpoint-validation flaw in drivers/usb/atm/cxacru.c found by Syzbot and fixed upstream. The bundle lacks CVSS, CWE, impact classification, and exploitability detail, so severity and practical impact remain partly uncertain.
Mitigation direction
- Apply the relevant Linux kernel or distribution security update.
- Review the referenced stable kernel commits for fixed branches.
- Check Debian LTS advisories if running Debian-based systems.
- Limit untrusted USB device access until patched.
- Follow vendor guidance for temporary controls if updates are delayed.
Validation and detection
- Inventory Linux kernel versions across affected fleets.
- Check whether the cxacru USB ATM driver is present or loadable.
- Confirm patched kernel versions or referenced fixes are installed.
- Review asset classes with USB passthrough or physical USB exposure.
- Track vendor advisories for distribution-specific fixed package versions.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit dcd592ab9dd8
- Linux stable commit 319529e0356b
- Linux stable commit bf4409f84023
- Linux stable commit 197e78076c5e
- Linux stable commit a0475a885d69
- Linux stable commit cfc295f7cccf
- Linux stable commit 903b80c21458
- Linux stable commit c90aad369899
- Debian LTS advisory May 2025 msg00045
- Debian LTS advisory May 2025 msg00030
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21916 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/dcd592ab9dd8a2bfc36e75583b9006db2a77ec24CVE reference, Linux
- https://git.kernel.org/stable/c/319529e0356bd904528c64647725a2272d297c83CVE reference, Linux
- https://git.kernel.org/stable/c/bf4409f84023b52b5e9b36c0a071a121eee42138CVE reference, Linux
- https://git.kernel.org/stable/c/197e78076c5ecd895f109158c4ea2954b9919af6CVE reference, Linux
- https://git.kernel.org/stable/c/a0475a885d69849b1ade38add6d64338dfa83a8fCVE reference, Linux
- https://git.kernel.org/stable/c/cfc295f7cccf66cbd5123416bcf1bee2e1bd37deCVE reference, Linux
- https://git.kernel.org/stable/c/903b80c21458bb1e34c3a78c5fdc553821e357f8CVE reference, Linux
- https://git.kernel.org/stable/c/c90aad369899a607cfbc002bebeafd51e31900cdCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.