Security readout for executives and security teams
Plain-English summary
This is a Linux kernel reliability flaw in USB Type-C UCSI handling. Under affected kernel builds, resources can be freed before worker threads finish using them, causing a NULL pointer access. The main business impact is local denial of service, such as a system crash, not data theft or remote compromise based on the provided sources.
Executive priority
Handle through normal kernel patch management with moderate priority. Escalate for shared workstations, multi-user Linux systems, and fleets where local denial of service has operational impact. There is no provided evidence of remote compromise or active exploitation.
Technical view
CVE-2025-21918 is a CWE-476 NULL pointer dereference in the Linux kernel USB Type-C UCSI path. The fix waits for the associated workqueue to complete before deallocating resources. CVSS 3.1 is 5.5: local attack vector, low complexity, low privileges, no user interaction, and high availability impact only.
Likely exposure
Exposure is most relevant for Linux systems running affected kernel builds with USB Type-C UCSI support. The source bundle lists Linux kernel versions and stable commits, but does not provide complete distribution-specific affected range semantics beyond the Debian LTS reference.
Exploitation context
The source bundle does not report active exploitation, and KEV is false. The CVSS vector indicates local, low-privilege exploitation with no user interaction, affecting availability only. Treat this as a stability and local denial-of-service risk unless vendor advisories say otherwise.
Researcher notes
The issue is a lifetime/order-of-destruction bug: resources were released before workqueue users were finished. Analysis should focus on affected kernel lineage, distribution backports, and whether local users can trigger UCSI cleanup paths. The prompt does not include proof-of-concept details.
Mitigation direction
- Apply vendor kernel updates that include the referenced upstream stable fixes.
- Check Debian LTS guidance if managing Debian systems.
- Prioritize systems where local users or workloads can interact with USB Type-C paths.
- Avoid inventing configuration workarounds; follow vendor kernel guidance.
- Reboot into the fixed kernel after patch deployment.
Validation and detection
- Inventory running kernel versions across Linux assets.
- Confirm whether USB Type-C UCSI support is present or enabled.
- Compare deployed kernels against vendor advisories and referenced stable commits.
- Verify patched systems boot into the updated kernel.
- Monitor for recurring kernel crashes tied to USB Type-C/UCSI activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21918 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7a735a8a46f6ebf898bbefd96659ca5da798bce0CVE reference, Linux
- https://git.kernel.org/stable/c/46fba7be161bb89068958138ea64ec33c0b446d4CVE reference, Linux
- https://git.kernel.org/stable/c/079a3e52f3e751bb8f5937195bdf25c5d14fdff0CVE reference, Linux
- https://git.kernel.org/stable/c/592a0327d026a122e97e8e8bb7c60cbbe7697344CVE reference, Linux
- https://git.kernel.org/stable/c/b13abcb7ddd8d38de769486db5bd917537b32ab1CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.