Security readout for executives and security teams
Plain-English summary
This Linux kernel issue affects systems using iSCSI boot with IPv6. A kernel path handling iBFT network attributes can trigger undefined behavior when representing an IPv6 prefix as a subnet mask. The source bundle rates it high, but exposure appears narrow and tied to local access plus specific boot configuration.
Executive priority
Treat as high priority for infrastructure teams managing Linux iSCSI-booted systems. For general Linux fleets, prioritize normal kernel patch cycles unless iSCSI IPv6 boot is present.
Technical view
The flaw is in iscsi_ibft ibft_attr_show_nic(). When iscsistart reads the subnet-mask sysfs attribute during IPv6 iSCSI boot, a prefix length of 64 can produce a negative shift exponent, triggering a UBSAN shift-out-of-bounds condition. Kernel stable commits set the value to ~0 because IPv6 has no subnet-mask concept.
Likely exposure
Most exposed assets are Linux hosts that boot from iSCSI using IPv6 and run affected kernel versions. The CVSS vector is local with low privileges required, so internet-facing exposure is not indicated by the provided sources.
Exploitation context
The provided bundle does not show KEV listing or active exploitation. Practical exploitation evidence is incomplete; the public description confirms a UBSAN shift-out-of-bounds condition, while the CVSS indicates potential confidentiality and availability impact.
Researcher notes
The evidence names a specific kernel logic error and stable fixes but does not demonstrate exploitation. Validate branch-specific impact carefully because affected version data is broad and includes multiple stable kernel lines.
Mitigation direction
- Apply distribution or vendor kernel updates that include the referenced stable fixes.
- Prioritize Linux systems using iSCSI boot with IPv6.
- Review Debian LTS advisories if running affected Debian kernels.
- If no patched kernel is available, follow vendor guidance for temporary risk reduction.
Validation and detection
- Inventory Linux kernel versions across servers and virtual machines.
- Identify hosts using iSCSI boot, especially with IPv6 configuration.
- Check vendor advisories for a fixed kernel package or backported patch.
- Confirm patched systems include the applicable stable commit for their kernel branch.
Public sources used
- CVE Program
- CVE List V5
- Kernel stable commit a858cd58
- Kernel stable commit f763c82d
- Kernel stable commit b388e185
- Kernel stable commit 9bfa80c8
- Kernel stable commit 2d1eef24
- Kernel stable commit b253660f
- Kernel stable commit c1c6e527
- Kernel stable commit 07e0d99a
- Debian LTS announcement May 2025 45
- Debian LTS announcement May 2025 30
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21993 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a858cd58dea06cf85b142673deea8c5d87f11e70CVE reference, Linux
- https://git.kernel.org/stable/c/f763c82db8166e28f45b7cc4a5398a7859665940CVE reference, Linux
- https://git.kernel.org/stable/c/b388e185bfad32bfed6a97a6817f74ca00a4318fCVE reference, Linux
- https://git.kernel.org/stable/c/9bfa80c8aa4e06dff55a953c3fffbfc68a3a3b1cCVE reference, Linux
- https://git.kernel.org/stable/c/2d1eef248107bdf3d5a69d0fde04c30a79a7bf5dCVE reference, Linux
- https://git.kernel.org/stable/c/b253660fac5e0e9080d2c95e3a029e1898d49afbCVE reference, Linux
- https://git.kernel.org/stable/c/c1c6e527470e5eab0b2d57bd073530fbace39eabCVE reference, Linux
- https://git.kernel.org/stable/c/07e0d99a2f701123ad3104c0f1a1e66bce74d6e5CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.