Security readout for executives and security teams
Plain-English summary
A local, low-privileged Linux user may abuse missing permission checks in bcachefs subvolume destruction. The flaw can also leave inode eviction stuck because cache entries are pruned incorrectly. Successful abuse could seriously disrupt data integrity and system availability, but the supplied evidence does not establish remote or active exploitation.
Executive priority
Prioritize affected multi-user or workload-hosting systems that actively use bcachefs. Schedule prompt kernel remediation because integrity and availability impacts are high. Systems without bcachefs use are less likely to be practically exposed, but package status should still be verified.
Technical view
CVE-2025-22019 affects the Linux kernel’s bcachefs bch2_ioctl_subvolume_destroy() path. The resolution corrects missing authorization checks and faulty dcache pruning in bch2_evict_subvolume_inodes(). CVSS 3.1 rates it 7.3: local access, low complexity, low privileges, no interaction, with high integrity and availability impact.
Likely exposure
Exposure requires an affected Linux kernel and use of bcachefs. The supplied record identifies affected upstream versions including 6.7, 6.12.22, 6.13.10, and 6.14.2, but its version data is ambiguous. Confirm distribution-specific package status and whether bcachefs filesystems are present.
Exploitation context
The CVSS vector describes local exploitation requiring low privileges, without user interaction. The supplied bundle marks the CVE as absent from KEV and provides no evidence of public or active exploitation. Internet exposure alone does not establish reachability; local account, workload, or container access may matter.
Researcher notes
The source identifies two defects: missing permission checks and an inode-eviction hang caused by incorrect dcache pruning. No CWE classification, exploit evidence, or complete distribution package mapping is supplied. Treat affected-version boundaries cautiously and validate fixes against vendor backports or the four referenced Linux stable commits.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable fix.
- Consult the Linux distribution’s advisory to map patched package versions accurately.
- Restrict unnecessary local accounts and privileged workload access pending patching.
- Avoid relying on upstream version numbers alone when assessing distribution kernels.
Validation and detection
- Record the running kernel and distribution package release on every Linux host.
- Determine whether bcachefs is configured, mounted, or used for stored data.
- Compare kernel packages with vendor advisories and the referenced stable commits.
- Confirm patched kernels are running after installation and required reboots.
- Review local-access controls and suspicious bcachefs subvolume operations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22019 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9e6e83e1e2d01b99e70cd7812d7f758a8def9fc8CVE reference, Linux
- https://git.kernel.org/stable/c/82383abd39abd635511b8956284a5cc8134c4dc1CVE reference, Linux
- https://git.kernel.org/stable/c/558317a5c61045d460a37372181e7b43c0c002bbCVE reference, Linux
- https://git.kernel.org/stable/c/707549600c4a012ed71c0204a7992a679880bf33CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.