Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can corrupt data and force a kernel crash when several network-filesystem read operations donate data to the same follow-on request in an unlucky completion order. The supplied record rates it 9.8 critical, but the public description specifically demonstrates corruption and denial of service rather than every impact implied by that score.
Executive priority
Treat this as an urgent kernel maintenance issue for systems using the affected netfs path, particularly where crashes or data corruption would disrupt critical services. Validate actual exposure before assuming universal remote compromise, and deploy vendor-supported updates through normal emergency change controls.
Technical view
In fs/netfs/read_collect, multiple completed subrequests can overwrite the same next request’s prev_donated field instead of accumulating donations. This corrupts request bookkeeping and can trigger the kernel BUG message “Can't donate prior to front.” The referenced stable-kernel commits resolve the accounting error.
Likely exposure
Exposure requires an affected Linux kernel and execution of the relevant netfs read path with multiple subrequests completing in the problematic order. The supplied version data identifies Linux 6.12-related releases, but its flattened version entries do not establish precise vulnerable ranges or distribution backport status.
Exploitation context
The supplied record is not in CISA KEV, and no cited source establishes active exploitation or a public exploit. Although the CVSS vector marks network reachability without privileges or interaction, the source bundle does not explain how an external attacker could reliably trigger the required filesystem state.
Researcher notes
The stated failure depends on completion ordering, suggesting a concurrency-sensitive bookkeeping defect. No CWE is supplied. The description substantiates data corruption and a BUG-triggered crash; confidentiality loss and reliable remote code execution are not demonstrated by the provided evidence. Exact affected ranges require vendor or distribution confirmation.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable referenced stable-kernel fix.
- Check distribution advisories for backported fixes; package versions may differ from upstream versions.
- Prioritize systems actively using Linux network-filesystem functionality.
- Use vendor guidance for temporary mitigations if immediate kernel replacement is impractical.
Validation and detection
- Inventory running kernel versions across Linux hosts and affected workload images.
- Confirm remediation through vendor advisories or inclusion of the referenced upstream fix.
- Identify systems exercising netfs-backed read paths and prioritize their testing.
- Review kernel logs for BUG crashes containing “Can't donate prior to front.”
- Regression-test network-filesystem reads after updating the kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21988 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/62b9ad7e52d4777f7e775ee1f0ad2452f6041024CVE reference, Linux
- https://git.kernel.org/stable/c/e25cec3b76aba47a49138d2162fc809c6cd49c9eCVE reference, Linux
- https://git.kernel.org/stable/c/e2d46f2ec332533816417b60933954173f602121CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.