Security readout for executives and security teams
Plain-English summary
A Linux networking bug can leave packet metadata with inconsistent ownership. In a documented OpenVSwitch traffic path, this can trigger a kernel failure and disrupt hosts. The supplied CVSS score is 7.8 (high), but exposure depends on local access, an affected kernel, and the specific packet-processing sequence.
Executive priority
Handle through the high-priority kernel patching process, with expedited treatment for OpenVSwitch-enabled production infrastructure. The potential host disruption is serious, but the supplied evidence indicates constrained local attack conditions and does not establish active exploitation.
Technical view
In __udp_gso_segment, the skb destructor is removed while its socket reference remains. When OpenVSwitch processes a userspace action before an output action, the original skb may later reach skb_orphan and trigger a kernel BUG. Referenced stable commits correct ownership by also removing the socket reference.
Likely exposure
Most likely exposure is on Linux hosts using OpenVSwitch and UDP GSO where OVS_ACTION_ATTR_USERSPACE precedes OVS_ACTION_ATTR_OUTPUT. CVSS indicates local access, low privileges, and no user interaction. The supplied version data lacks reliable per-branch fixed boundaries, so vendor kernel and backport status must be verified.
Exploitation context
The bundle reports KEV status as false, and no supplied source establishes active exploitation or a public exploit. The documented result is a kernel BUG after skb_orphan. Although CVSS assigns high confidentiality, integrity, and availability impacts, the technical narrative directly demonstrates a crash, not confirmed data theft or code execution.
Researcher notes
The bundle repeats an introducing commit and flattens several branch versions without dependable boundary semantics. Map the referenced stable fixes to each distribution kernel before declaring exposure. The ownership defect is specifically documented, but claims beyond the demonstrated skb_orphan kernel BUG are unsupported by the supplied evidence.
Mitigation direction
- Apply vendor kernel packages containing the referenced __udp_gso_segment ownership fix.
- Reboot updated hosts so the corrected kernel is running.
- Prioritize OpenVSwitch hosts processing UDP GSO traffic.
- If patching is delayed, consult distribution guidance for supported risk reductions.
Validation and detection
- Inventory running kernel releases and check vendor advisories for CVE-2025-21926.
- Identify hosts using OpenVSwitch and workflows combining userspace and output actions.
- Confirm the running kernel contains the applicable stable backport.
- Review system logs for kernel BUG, skb_orphan, or ip_rcv_core signatures.
- Regression-test affected network flows after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21926 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9f28205ddb76e86cac418332e952241d85fed0dcCVE reference, Linux
- https://git.kernel.org/stable/c/a2d1cca955ed34873e524cc2e6e885450d262f05CVE reference, Linux
- https://git.kernel.org/stable/c/455217ac9db0cf9349b3933664355e907bb1a569CVE reference, Linux
- https://git.kernel.org/stable/c/e8db70537878e1bb3fd83e5abcc6feefc0587828CVE reference, Linux
- https://git.kernel.org/stable/c/01a83237644d6822bc7df2c5564fc81b0df84358CVE reference, Linux
- https://git.kernel.org/stable/c/084819b0d8b1bd433b90142371eb9450d657f8caCVE reference, Linux
- https://git.kernel.org/stable/c/c32da44cc9298eaa6109e3fc2c2b4e07cc4bf11bCVE reference, Linux
- https://git.kernel.org/stable/c/ee01b2f2d7d0010787c2343463965bbc283a497fCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.