Security readout for executives and security teams
Plain-English summary
A Linux kernel networking flaw can allow receive-only packet memory that the system cannot safely read to enter a device’s transmit path. The device may then process invalid DMA addresses, potentially compromising confidentiality, integrity, or availability. Exposure depends on using netmem/devmem receive functionality with packet forwarding or redirection into transmission.
Executive priority
Treat as urgent for infrastructure using device-memory networking or advanced packet redirection. Rapidly identify those systems and schedule vendor-supported kernel remediation. For other Linux hosts, confirm vendor status before emergency disruption because the vulnerable path appears configuration-dependent and the supplied version boundaries are incomplete.
Technical view
Stable kernels supported netmem/devmem RX without equivalent TX support. An unreadable socket buffer could nevertheless be forwarded or redirected into a driver’s TX path, where DMA-mapping APIs might receive addresses that must not be passed to the device. The linked kernel changes prevent transmission of these unreadable buffers.
Likely exposure
The bundle identifies Linux kernel releases including 6.12, 6.12.20, 6.13.8, and 6.14 as affected, but its version metadata is ambiguous. Systems using netmem/devmem RX and forwarding or redirecting received packets into a device TX path are the clearest exposure candidates. Ordinary installations without that data flow may face lower practical risk.
Exploitation context
The supplied CVSS rating is 9.8 and models network exploitation without privileges or user interaction. However, the sources provide no demonstrated exploit, attack details, or evidence of exploitation in the wild. The CVE is not listed as KEV in the bundle, and practical exploitability remains unclear.
Researcher notes
The central invariant is that an unreadable skb must never enter the TX path. Review the linked stable commits for branch-specific implementation details and backport ancestry. The bundle does not establish how a remote actor creates the required buffer state, whether hardware or driver behavior changes impact, or which packaged distribution kernels contain the correction.
Mitigation direction
- Apply a vendor-approved kernel update containing the applicable linked fix after compatibility testing.
- Check distribution or kernel-vendor guidance for exact affected and corrected release boundaries.
- Avoid redirecting or forwarding devmem/netmem RX packets into device transmission until remediated.
- Prioritize systems using advanced packet processing, traffic control redirection, or device-memory networking.
Validation and detection
- Inventory kernel versions and compare them with current distribution vulnerability advisories.
- Confirm the running kernel includes the applicable linked upstream or stable fix.
- Review networking configuration for devmem/netmem RX combined with forwarding or traffic-control redirection.
- Verify unreadable socket buffers are rejected before reaching the network driver’s transmit path.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21954 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/454825019d2f0c59e5174ece9e713f45ad80beffCVE reference, Linux
- https://git.kernel.org/stable/c/1c17c8ced25c5fbe424c7ad7ea11d33014a986b1CVE reference, Linux
- https://git.kernel.org/stable/c/f3600c867c99a2cc8038680ecf211089c50e7971CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.