Security readout for executives and security teams
Plain-English summary
A Linux networking-driver flaw can crash the kernel when an mlx5 link-aggregation device is removed from a bridge. A queued bridge event can retain a reference to an already destroyed bond interface. The impact could disrupt servers or network appliances, but exposure requires the affected mlx5 bridge and LAG configuration.
Executive priority
Prioritize patching network infrastructure and production hosts matching the mlx5 bridge/LAG configuration. Treat this as a high operational-availability concern, especially where a kernel crash would interrupt critical traffic. Broader emergency action is not supported because exposure is configuration-dependent and active exploitation is unconfirmed.
Technical view
During LAG removal, mlx5 may skip flushing offloaded forwarding entries when a physical function is unloaded. A surviving entry continues generating workqueue events without proper aging. The bridge notifier then accesses the destroyed bond netdev and triggers a kernel Oops. Linux stable commits remove the problematic state checks while retaining earlier LAG validation.
Likely exposure
Most likely exposed are Linux hosts using mlx5 hardware or drivers with bridge offload and bonded or LAG interfaces. The source identifies affected 5.15 and 6.x kernel lines, but package backports make version-only conclusions unreliable. Ordinary systems without this networking configuration appear less exposed.
Exploitation context
The CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction. The supplied sources demonstrate a kernel crash path. CISA KEV status is false, and the bundle provides no evidence of active exploitation or a public exploit.
Researcher notes
The documented failure combines skipped FDB flushing, stale last-use handling, repeated mlx5 bridge workqueue events, and access to a destroyed bond netdev. The bundle does not identify a CWE or prove confidentiality or integrity compromise despite the CVSS impacts. Exact affected package ranges require distribution-specific confirmation.
Mitigation direction
- Install a vendor-supported kernel containing the applicable Linux stable fix.
- Check distribution advisories because patched package versions may differ from upstream versions.
- Prioritize mlx5 hosts using bridges with bonded or LAG interfaces.
- Avoid unnecessary LAG removal or reconfiguration until affected systems are patched.
Validation and detection
- Inventory mlx5 drivers, bridge offload, bonding, and LAG usage on Linux hosts.
- Compare installed kernel packages with vendor advisories and applicable stable commits.
- Review kernel logs for mlx5 bridge workqueue Oops or br_switchdev_event crashes.
- Validate the patched kernel through controlled network reconfiguration testing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21970 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f90c4d6572488e2bad38cca00f1c59174a538a1aCVE reference, Linux
- https://git.kernel.org/stable/c/86ff45f5f61ae1d0d17f0f6d8797b052eacfd8f1CVE reference, Linux
- https://git.kernel.org/stable/c/bd7e3a42800743a7748c83243e4cafc1b995d4c4CVE reference, Linux
- https://git.kernel.org/stable/c/f7bf259a04271165ae667ad21cfc60c6413f25caCVE reference, Linux
- https://git.kernel.org/stable/c/5dd8bf6ab1d6db40f5d09603759fa88caec19e7fCVE reference, Linux
- https://git.kernel.org/stable/c/4b8eeed4fb105770ce6dc84a2c6ef953c7b71cbbCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.