Security readout for executives and security teams
Plain-English summary
A locally authorized user who can influence a Linux BPF scheduler may supply an invalid CPU identifier and crash the kernel. This can disrupt affected servers or workloads. The supplied description confirms a crash, but does not establish remote exploitation or arbitrary code execution.
Executive priority
Treat as a high-priority stability issue on multi-user or sched_ext-enabled Linux systems. Accelerate patching where untrusted local users can influence BPF schedulers. Other systems should follow normal kernel maintenance after confirming vendor applicability.
Technical view
CVE-2025-21965 affects sched_ext handling in scx_bpf_select_cpu_dfl(). An invalid prev_cpu outside nr_cpu_ids was not validated, allowing a BPF scheduler to trigger a kernel crash. The correction validates prev_cpu and raises an sched_ext error. CVSS 3.1 is 7.8 with local access and low privileges required.
Likely exposure
Exposure is most plausible where affected Linux kernels run sched_ext BPF schedulers and lower-privileged users can influence them. The bundle lists affected 6.12, 6.12.20, 6.13.8, and 6.14 entries, but does not provide reliable distribution-specific package mappings.
Exploitation context
The supplied record is not in KEV and contains no evidence of active exploitation. Exploitation requires local access, low privileges, and a BPF scheduler capable of passing an invalid CPU value. The documented result is a kernel crash.
Researcher notes
The source establishes missing bounds validation and a kernel-crash outcome. Although the CVSS vector assigns high confidentiality, integrity, and availability impacts, the supplied narrative does not demonstrate data disclosure, privilege escalation, or code execution. No CWE or public exploitation evidence is provided.
Mitigation direction
- Install a vendor-supported kernel containing the referenced prev_cpu validation fix.
- Check distribution security guidance for package-specific fixed versions and backports.
- Until patched, restrict who can load, configure, or control BPF schedulers.
- Prioritize exposed multi-user systems and hosts using sched_ext scheduling.
Validation and detection
- Inventory kernel versions and distribution package revisions across potentially affected hosts.
- Confirm whether vendor packages include one of the referenced fixes or an equivalent backport.
- Identify systems where sched_ext and custom BPF schedulers are enabled or used.
- After updating, verify the fixed kernel is running following any required reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21965 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/752b56bb76e2471197d25d6948d85753043b10daCVE reference, Linux
- https://git.kernel.org/stable/c/515680e76c536dd4aa8e2b5d674b0d441baddf5bCVE reference, Linux
- https://git.kernel.org/stable/c/9360dfe4cbd62ff1eb8217b815964931523b75b3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.