Security readout for executives and security teams
Plain-English summary
A flaw in the Linux qaic accelerator driver can let a logged-in, low-privilege user submit values that wrap during arithmetic validation. The supplied CVSS assessment indicates possible complete loss of confidentiality, integrity, and availability. Exposure depends on whether the vulnerable driver and affected request path are available.
Executive priority
Treat as a high-priority local privilege-boundary risk on shared systems using qaic acceleration. Inventory exposed hosts promptly and apply vendor-corrected kernels. Lower priority for systems without the driver or without untrusted local access, after confirming those conditions.
Technical view
User-controlled 64-bit values passed through qaic_attach_slice_bo_ioctl() could overflow when qaic_validate_req() performs addition. Wrapped results may bypass intended bounds validation. The kernel fix applies check_add_overflow() before accepting the calculation. The CVSS 3.1 vector is local, low complexity, low privileges, no user interaction, with high impact across confidentiality, integrity, and availability.
Likely exposure
Most relevant to Linux systems exposing the affected accel/qaic driver to untrusted local users or workloads. The supplied version data names 6.4, 6.6.85, 6.12.21, 6.13.9, and 6.14, but its duplicated commit entries make exact affected ranges unclear. Confirm against distribution or kernel-vendor advisories.
Exploitation context
The supplied CVSS vector describes local exploitation requiring low privileges and no user interaction. The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Remote exploitation is not supported by the supplied evidence.
Researcher notes
The defect is CWE-190 integer overflow in request validation, corrected with checked addition. Impact is scored broadly, but the supplied sources do not document demonstrated exploitation outcomes. Version metadata is incomplete or ambiguous, including repeated commit identifiers and no CPEs; use commit presence and vendor package advisories for reliable exposure decisions.
Mitigation direction
- Install a vendor kernel containing the applicable referenced stable fix.
- Prioritize multi-user hosts where untrusted users or workloads can access the qaic driver.
- If immediate updating is impossible, restrict untrusted access to affected qaic device interfaces.
- Consult distribution guidance for exact affected and corrected package versions.
Validation and detection
- Record the running kernel and distribution package versions on systems using qaic.
- Confirm whether the accel/qaic driver is present, enabled, and accessible to untrusted users.
- Verify the installed kernel includes the applicable referenced stable commit or vendor backport.
- Recheck device permissions and workload isolation after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22001 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4b2a170c25862ad116bd31be6b9841646b4862e8CVE reference, Linux
- https://git.kernel.org/stable/c/b362fc904d264a88b4af20baae9e82491c285e9cCVE reference, Linux
- https://git.kernel.org/stable/c/57fae0c505f49bb1e3d5660cd2cc49697ed85f7cCVE reference, Linux
- https://git.kernel.org/stable/c/67d15c7aa0864dfd82325c7e7e7d8548b5224c7bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.