LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21935: rapidio: add check for rio_add_net() in rio_scan_alloc_net()

In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rio_add_net() in rio_scan_alloc_net() The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-21935 is a Linux kernel RapidIO defect where a failed network-add operation was not handled correctly. The source describes a memory/reference cleanup issue, not a confirmed remote compromise path. Business urgency depends on whether affected Linux kernels with RapidIO code are deployed in your environment.

Executive priority

Track and remediate through normal kernel patch management unless your environment uses RapidIO-capable systems. There is insufficient source evidence for emergency response, but unsupported or exposed kernel deployments should not defer vendor updates.

Technical view

In rio_scan_alloc_net(), the kernel did not check rio_add_net() failure. The fix checks the return value and calls put_device() to release memory and the reference initialized during rio_add_net(). Public data provides no CVSS, CWE, or confirmed impact beyond the resolved cleanup flaw.

Likely exposure

Exposure is likely limited to Linux systems running affected kernel code where RapidIO support is present or reachable. The bundle lists Linux kernel versions and stable commits, but does not identify specific distributions beyond Debian LTS advisories.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation, public exploit use, or weaponized proof of concept. Treat exploitability as unconfirmed from the supplied evidence.

Researcher notes

Evidence is limited to the kernel fix description, upstream stable commit references, and Debian LTS announcements. The supplied record lacks CVSS, CWE, crash details, privilege context, and exploitability analysis, so conclusions should remain conservative.

Mitigation direction

  • Update affected Linux kernels using vendor-supported security packages.
  • Review the referenced upstream stable commits for applicable maintained kernel branches.
  • Apply relevant Debian LTS kernel updates where Debian LTS is in use.
  • Prioritize systems where RapidIO support is enabled, loaded, or operationally required.
  • If vendor status is unclear, follow the vendor advisory rather than inferring fixed versions.

Validation and detection

  • Inventory running kernel versions across Linux assets.
  • Check whether RapidIO kernel support is configured, loaded, or used.
  • Map each kernel package to vendor advisories for CVE-2025-21935.
  • Confirm deployed kernels include the referenced upstream stable fix.
  • Record exceptions where RapidIO is absent and vendor risk is downgraded.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21935 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe6b585ca6e81badeb3d42db3cc408174f2826034, e6b585ca6e81badeb3d42db3cc408174f2826034, e6b585ca6e81badeb3d42db3cc408174f2826034, e6b585ca6e81badeb3d42db3cc408174f2826034, e6b585ca6e81badeb3d42db3cc408174f2826034, e6b585ca6e81badeb3d42db3cc408174f2826034, e6b585ca6e81badeb3d42db3cc408174f2826034, e6b585ca6e81badeb3d42db3cc408174f2826034unaffected
LinuxLinux4.6, 0, 5.4.291, 5.10.235, 5.15.179, 6.1.131, 6.6.83, 6.12.19, 6.13.7, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.