Security readout for executives and security teams
Plain-English summary
CVE-2025-21917 is a Linux kernel reliability flaw in the Renesas USBHS driver. On Renesas RZ/G2L systems, repeated USB driver bind/unbind activity can leave delayed work running after resources are unavailable, causing a kernel NULL pointer crash. The business impact is service outage on affected embedded or edge devices, not data theft.
Executive priority
Schedule patching for affected embedded and operational devices, especially where downtime is costly or local access is plausible. This is not a broad internet-facing emergency based on the provided evidence, but it can cause hard outages on affected hardware.
Technical view
The issue is a CWE-476 NULL pointer dereference in usbhsc_notify_hotplug(). The kernel fix flushes notify_hotplug_work so delayed hotplug handling cannot execute after driver resources are gone. CVSS 3.1 is 5.5, local attack vector, low complexity, low privileges, no confidentiality or integrity impact, high availability impact.
Likely exposure
Exposure is most likely on Linux-based products using Renesas RZ/G2L SoCs with the renesas_usbhs driver and affected kernel lines. General Linux servers are unlikely to be exposed unless this hardware and driver path are present. Debian LTS advisories indicate downstream kernel updates exist for some Debian-supported environments.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The described trigger involves local continuous USB driver bind/unbind operations. Treat this as a local denial-of-service risk where a user or process can interact with relevant driver controls.
Researcher notes
Focus analysis on Renesas USBHS hotplug delayed work lifecycle during driver removal. The source evidence supports availability impact only. Affected-version data in the bundle is broad and partially commit-oriented, so product-specific exposure requires kernel configuration, hardware, and downstream vendor advisory correlation.
Mitigation direction
- Apply vendor or distribution kernel updates containing the referenced stable fixes.
- For Debian LTS systems, review the cited Debian advisories and update affected kernel packages.
- Prioritize affected Renesas RZ/G2L devices that support local users or field maintenance access.
- Restrict non-administrative access to driver management interfaces until patched.
- Check vendor guidance if your product uses a customized or board-support kernel.
Validation and detection
- Inventory systems using Renesas RZ/G2L SoCs or the renesas_usbhs Linux driver.
- Compare deployed kernel versions against vendor or distribution fixed releases.
- Verify kernel changelogs reference CVE-2025-21917 or the relevant stable commit.
- Confirm update deployment through package inventory or firmware build records.
- Use lab validation only; avoid crash testing production devices.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 4cd847a
- Linux stable commit 394965f
- Linux stable commit 3248c1f
- Linux stable commit 4ca0780
- Linux stable commit d50f5c0
- Linux stable commit e5aac1c
- Linux stable commit 830818c
- Linux stable commit 552ca6b
- Debian LTS advisory May 2025 msg00045
- Debian LTS advisory May 2025 msg00030
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21917 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4cd847a7b630a85493d0294ad9542c21aafaa246CVE reference, Linux
- https://git.kernel.org/stable/c/394965f90454d6f00fe11879142b720c6c1a872eCVE reference, Linux
- https://git.kernel.org/stable/c/3248c1f833f924246cb98ce7da4569133c1b2292CVE reference, Linux
- https://git.kernel.org/stable/c/4ca078084cdd5f32d533311d6a0b63a60dcadd41CVE reference, Linux
- https://git.kernel.org/stable/c/d50f5c0cd949593eb9a3d822b34d7b50046a06b7CVE reference, Linux
- https://git.kernel.org/stable/c/e5aac1c9b2974636db7ce796ffa6de88fa08335eCVE reference, Linux
- https://git.kernel.org/stable/c/830818c8e70c0364e377f0c243b28061ef7967ebCVE reference, Linux
- https://git.kernel.org/stable/c/552ca6b87e3778f3dd5b87842f95138162e16c82CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.