Security readout for executives and security teams
Plain-English summary
CVE-2025-22006 is a Linux kernel reliability flaw in the TI AM65 CPSW Ethernet driver. A timing issue can cause a NULL pointer dereference and crash networking or the system. The main business risk is availability loss on affected embedded or Linux systems using this driver. No source provided indicates active exploitation.
Executive priority
Treat as a targeted availability risk for affected Linux embedded platforms. Prioritize remediation where these devices support production networking, industrial operations, or remote sites. Broad enterprise urgency is lower unless TI AM65 CPSW-based systems are in use.
Technical view
The flaw is in net/ethernet/ti/am65-cpsw. TX or RX DMA interrupts could be registered before the corresponding NAPI callbacks. If traffic occurs in that window, the kernel may dereference NULL. The CVE maps to CWE-476 and CVSS 5.5, with availability impact only. Stable kernel commits are listed as fixes.
Likely exposure
Exposure is likely limited to Linux systems using the TI AM65 CPSW Ethernet driver, commonly relevant to specific TI-based embedded platforms. General Linux servers not using this driver are unlikely to be affected. The provided data does not fully enumerate all vulnerable kernel branches or downstream vendor packages.
Exploitation context
The CVSS vector indicates local access with low privileges, no user interaction, and high availability impact. The description also notes the crash depends on traffic timing from Linux and the network. There is no KEV listing and no cited evidence of active exploitation.
Researcher notes
The public record describes a race/order-of-registration bug rather than memory corruption with confidentiality impact. Affected-version data in the bundle is limited and commit-oriented. Validate against the exact kernel tree used by the device or distribution, because downstream vendors may backport fixes without changing major kernel versions.
Mitigation direction
- Update to a kernel or vendor package containing the referenced stable fixes.
- Check Linux distribution or device vendor advisories for backported patches.
- Prioritize affected embedded devices where network availability is operationally important.
- If patching is delayed, monitor for kernel crashes involving am65-cpsw or NAPI.
Validation and detection
- Inventory systems for TI AM65 CPSW Ethernet hardware or driver usage.
- Confirm the running kernel includes one of the referenced stable fix commits.
- Review vendor kernel changelogs for CVE-2025-22006 or the NAPI registration fix.
- Check crash logs for NULL pointer dereferences in the am65-cpsw driver.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22006 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d4bf956547c38c04fad8d72a961ac4dc00bad000CVE reference, Linux
- https://git.kernel.org/stable/c/942557abed7f38b77a47d77b92d448802eefe185CVE reference, Linux
- https://git.kernel.org/stable/c/5f079290e5913a0060e059500b7d440990ac1066CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.