Security readout for executives and security teams
Plain-English summary
This is a Linux kernel Bluetooth flaw that can crash affected systems through a null pointer dereference. It is primarily an availability risk, not a data theft or privilege escalation issue based on the supplied CVSS vector. Exploitation requires local access with low privileges, so prioritize exposed multi-user Linux systems and endpoints where Bluetooth is enabled.
Executive priority
Treat as a routine but real availability patch. It is not currently evidenced as exploited and does not indicate data compromise, but kernel crashes can disrupt business services. Include it in the next kernel maintenance cycle, faster for shared Linux systems with local users.
Technical view
The kernel Bluetooth management path mgmt_device_connected() did not check whether mgmt_alloc_skb() returned null. The upstream resolution adds that check to prevent a null pointer dereference. The CVSS vector is local, low complexity, low privileges, no user interaction, unchanged scope, and high availability impact only.
Likely exposure
Affected exposure is limited to Linux kernels identified by the CVE data and downstream distributions carrying vulnerable Bluetooth code. Systems without Bluetooth use or without local untrusted users are lower priority, but still need normal kernel patch management.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. The CVSS vector indicates local, low-privilege exploitation with no user interaction and high availability impact. No public exploit status is established by the provided evidence.
Researcher notes
Focus analysis on the Bluetooth management code path and vendor backport status. The affected-version data in the bundle is sparse and somewhat irregular, so rely on distro advisories and kernel package metadata for final exposure decisions. Do not infer remote attackability from the Bluetooth component alone.
Mitigation direction
- Apply vendor kernel updates that include the referenced upstream stable fixes.
- For Debian LTS systems, review and follow the cited Debian LTS advisory.
- Prioritize multi-user Linux systems and endpoints where Bluetooth is enabled.
- If no vendor package is available, monitor vendor guidance for supported backports.
- Avoid direct deployment shortcuts; use normal tested kernel update processes.
Validation and detection
- Inventory Linux hosts and record running kernel versions and distribution packages.
- Check vendor advisories or changelogs for CVE-2025-21936 coverage.
- Confirm patched kernels include the applicable upstream stable fix or vendor backport.
- Review whether Bluetooth is enabled on systems pending patching.
- Regression-test critical workloads after kernel updates before broad rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21936 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/dc516e66fb28c61b248b393e2ddd63bd7f104969CVE reference, Linux
- https://git.kernel.org/stable/c/bdb1805c248e9694dbb3ffa8867cef2e52cf7261CVE reference, Linux
- https://git.kernel.org/stable/c/7841180342c9a0fd97d54f3e62c7369309b5cd84CVE reference, Linux
- https://git.kernel.org/stable/c/7d39387886ffe220323cbed5c155233c3276926bCVE reference, Linux
- https://git.kernel.org/stable/c/d8df010f72b8a32aaea393e36121738bb53ed905CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.