Security readout for executives and security teams
Plain-English summary
CVE-2025-21953 is a Linux kernel availability bug in the Microsoft MANA network driver. Under a failed resume during VM hibernation, stale debugfs state can be cleaned up twice and crash the kernel. The source indicates local access with low privileges and no confidentiality or integrity impact.
Executive priority
Treat as a moderate availability risk. Patch during the next kernel maintenance window, faster for hibernating Azure or MANA-backed workloads where an unplanned kernel crash would disrupt critical service.
Technical view
The MANA driver can leave mana_port_debugfs pointing at an already removed dentry after HWC creation fails during mana_gd_resume(). A later shutdown path calls debugfs_remove() again through mana_detach(), causing a NULL pointer dereference. CVSS is 5.5 with AV:L/PR:L/UI:N and availability high.
Likely exposure
Exposure appears limited to Linux systems using the MANA network driver, notably Microsoft virtual machine environments, where hibernation/resume and shutdown paths are used. The source lists Linux 6.13 through 6.13.8 and 6.14-related versions as affected.
Exploitation context
No active exploitation is stated in the provided sources, and CISA KEV is false. The crash condition is local and tied to VM hibernation failure handling, not remote network exploitation. Evidence supports denial of service, not data theft or privilege escalation.
Researcher notes
The bug is a stale debugfs pointer cleanup issue after failed MANA resume. Validation should focus on code provenance and kernel build lineage, because the source bundle provides fix commits but no standalone vendor advisory, exploit evidence, or operational workaround.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- Prioritize affected MANA-enabled VM images that use hibernation.
- If patching is delayed, check OS and cloud vendor guidance for supported workarounds.
- Track kernel versions against the affected ranges in the CVE record.
Validation and detection
- Inventory Linux VMs using the MANA network driver.
- Check running and packaged kernel versions against the CVE affected list.
- Confirm whether VM hibernation is enabled or operationally used.
- Verify installed kernels include one of the referenced stable commits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21953 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a1466112fb6e819261272ad75e7db750a43b78bfCVE reference, Linux
- https://git.kernel.org/stable/c/3e64bb2ae7d9f2b3a8259d4d6b86ed1984d5460aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.